# DF-5597 VERDICT

**Status: reproduced (hardening-gap demonstration, build-diff evidence
class). Impact: none today — the invariant currently holds; this finding
documents the unenforced invariant whose future drift is silent and
interrupt-routing-corrupting. Confidence: certain.**

## Facts established on the guest

1. **Current state is consistent.** The shipped kernel's generated assym.s
   contains `IOAPIC_IRQI_SIZE 0x10` and `IOAPIC_IRQI_SZSHIFT 0x4`;
   `ioapic_drift.c` (compiled from a verbatim copy of the struct) confirms
   `sizeof(struct ioapic_irqinfo) == 16 == 1 << 4` (`drift_now.log`).
   The independent TU cross-check (`findings/poc/DF-5596/out.kernelview.raw.txt`)
   reproduces both values from the real headers.
2. **Enforcement is comment-only.** grep over ioapic_abi.h and the apic
   directory finds no CTASSERT/_Static_assert/static_assert tying
   IOAPIC_IRQI_SZSHIFT to the struct size. genassym.c emits both numbers
   side by side (lines 276-277) but nothing compares them.
3. **Drift is silent today.** `ioapic_drift.c -DDRIFT` (one added
   `uint32_t io_owner_cpumask`) → `sizeof = 24`, stride stays 16
   (`drift_sim.log`): ioapic_ipl.s:80,97 (`shll $IOAPIC_IRQI_SZSHIFT`)
   and apic_vector.s:55-59 (`IOAPIC_IRQI_SIZE * irq`) would index
   `ioapic_irqs[]` differently — under-walked elements, wrong
   io_addr/io_idx/io_flags — and the kernel still builds and boots with
   no diagnostic.
4. **The proposed guard works.** With `_Static_assert` added
   (fix.diff): `guard_ok.log` — clean compile on the current layout
   (rc=0); `guard_drift.log` — `error: static assertion failed:
   "ioapic_irqinfo size drifted from IOAPIC_IRQI_SZSHIFT"` (rc≠0). The
   failure mode converts from silent runtime divergence to a loud
   build break.

## Why this is filed against genassym.c

genassym.c is the file that *publishes* both halves of this contract to
the assembly world; it is the natural place the audit asks "do the sizes
emitted match what consumers assume?" (checklist item d). The struct and
the hand constant live in ioapic_abi.h, which is where the one-line fix
belongs (fix.diff included).

## Classification

No runtime defect exists today (hence impact=none); this is a verified
hardening finding with a tested one-line fix. Severity Info.

## Fix status (batch validation)
Applied with the 36 sibling fix.diffs of this batch in findings/poc/_batch41/all_fixes.patch; single in-guest `make -j6 nativekernel KERNCONF=X86_64_GENERIC` completed RC=0 with zero errors under -Werror (full log: findings/poc/_batch41/fix_build8.log). Behavior A/B intentionally skipped for this Info-tier item.