# DF-5463 — PTIOCSETTIMEOUT signed-multiply overflow

`ptioctl()` (sys/bus/cam/scsi/scsi_pt.c:648-656) stores

    softc->io_timeout = *(int *)addr * 1000;      /* :654 */

with no upper bound. For `*(int*)addr > 2147483` the int multiply
overflows (UB) and `io_timeout` goes **negative**;
`PTIOCGETTIMEOUT` (:642-646) maps anything < 1000 ms to 0, so the wrap
is directly observable from userland. The negative value is later
consumed as a `u_int32_t` CDB timeout in `ptstart()` :483 →
`scsi_send_receive()` :691 (`cam_fill_csio` timeout) — a garbage
(negative-wrapped) timeout instead of a rejection.

Root-gated knob self-corruption (no memory-safety impact): hardening /
correctness finding.

## Prereq

Guest kernel with `device pt` (see ../DF-5462/README.md) and the ptsim
rig attached (pt0 present).

## Reproduce (guest, root)

    ./build.sh
    ./run.sh

## Expected

    set=100000     -> get=100000 (expect 100000)
    set=2147483    -> get=2147483 (expect 2147483)
    set=2147484    -> get=0      (expect 2147484; 0 == OVERFLOWED to negative)
    OVERFLOW-MANIFEST: io_timeout wrapped negative