# DF-5667 — vkernel64 is_globaldata_space() blesses all SMP_MAXCPU(256) reserved per-CPU slots while only ncpus are ever mapped

File: `sys/platform/vkernel64/platform/globaldata.c` (pass 2)

## What this is

An Info-grade latent API hazard, **runtime-proven**: on a stock VKERNEL64,
`is_globaldata_space()` (and therefore the MI `kernacc()`) returns TRUE for
~7.9 MB of *reserved but unmapped* kernel virtual address space (the per-CPU
slots of CPUs that do not exist). Today no in-tree caller can be harmed by
this (the sole `kernacc()` consumer chain on the vkernel, `/dev/kmem` →
`kvm_access_check()`, page-table-validates every page *before* consulting
`kernacc()`), but the lie is load-bearing API surface: any current or future
direct consumer of the MI `kernacc()` on a vkernel would take the TRUE at
face value, touch the page, and panic the vkernel.

## Reproduce (on the audit guest, as root)

```sh
# 1. build the vkernel (current HEAD needs the two defsyms: the vkernel64
#    links like a userspace binary — conf/Makefile:23 — and does not get the
#    __build_id_start/__build_id_end PROVIDEs its ldscript would provide)
cd /usr/src && make -j6 nativekernel KERNCONF=VKERNEL64 || true
cd /usr/obj/usr/src/sys/VKERNEL64
make -n kernel.debug 2>/dev/null | grep '^cc .*kernel.debug' > /tmp/linkcmd.txt
sh -c "$(cat /tmp/linkcmd.txt) -Wl,--defsym,__build_id_start=0 -Wl,--defsym,__build_id_end=0"
sh vk_image.sh          # builds /vkroot.img (minimal root + devfs)
sysctl vm.vkernel_enable=1
mkdir -p /var/vkernel

# 2. baseline run: boots a 2-vCPU vkernel, enters DDB via
#    sysctl debug.enter_debugger=ddb (DDB args MUST be 0x-hex; ddb input
#    radix is 16), drives call-probes at raw nm-derived addresses, then
#    scans every page of the window through /dev/kmem.
sh vk_probe4.sh         # decisive baseline: see run.log

# expected decisive lines (run.log):
#   db> call <is_globaldata_space>(0x8000420123, 0x800042012b)   -> 1   (dead slot blessed)
#   db> call <kernacc>(0x8000420123, 8, 1)                       -> 1   (MI kernacc lies)
#   db> call <pmap_kextract>(0x8000420123)                       -> 123 (garbage PA, pmap.c defect)
#   db> call <kvm_access_check>(0x8000420000, 0x8000421000, 1)   -> e   (EFAULT — PTE loop saves /dev/kmem)
#   db> call <kernacc>(0x8000400040, 8, 1)                       -> 1   (live slot, intended)
#   db> call <pmap_kextract>(0x8000400040)                       -> 197040 (real guest-phys)
#   PG 0 OK addr=549760008192        (slots 0+1 readable: 16 pages = 2*32KB)
#   PG 16 EF addr=549760073728       (first dead slot page -> EFAULT, uniformly, no porous pages)

# 3. fix validation: apply fix.diff to the guest's /usr/src copy, rebuild
#    globaldata.o, relink as above, rerun the identical driver:
#    is_globaldata_space(dead) 1 -> 0, all live probes unchanged, scan
#    unchanged. See run.fixed.log.
```

## Rig notes

- vkernel: `/usr/obj/usr/src/sys/VKERNEL64/kernel.debug -m 512m -r
  /vkroot.img -n 2 -e init_path=/bin/vkinit -s` (console via mkfifo;
  adapted from the DF-5655 rig).
- The vkernel's DDB has **no symbol table** (`kdb_init()` is `#if 0`'d in
  init.c) — all probes use raw `nm`-derived addresses.
- Measured layout (this build): `CPU_prvspace = 0x8000400000`,
  `sizeof(struct privatespace) = 0x8000` (32 KB), window = 256*32 KB = 8 MB
  reserved, slots 0..1 mapped (ncpus=2). `kernel_map` spans
  [0x8000000000, 0x1000000000000) — see VERDICT.md for the implications.