# DF-5679 — `sys/libkern/icrc32.c` pass-2 evidence pack

**File:** `sys/libkern/icrc32.c` (786 LOC) — classic CRC-32 table export
(`crc32_tab`, shared with `sys/libkern/crc32.c`) + CRC-32C single-table and
sliced-by-8 engines + `calculate_crc32c` / `iscsi_crc32` / `iscsi_crc32_ext`
public API.

**Consumers established (attack surface for length math):**
hammer2 (`hammer2_icrc32`/`icrc32c`, `sys/vfs/hammer2/hammer2.h:1457`),
hammer1 vol_version≥7 (`sys/vfs/hammer/hammer_crc.h:73-77`), swap-pager
write-verify (`sys/vm/swap_pager.c:1876`), dmsg wire protocol hdr/aux CRC
(`sys/kern/kern_dmsg.c:2009-2012`), ext2fs metadata CRC (seeded, incremental,
`sys/vfs/ext2fs/ext2_csum.c`), namei/vmount hashes, `crc32()`/`crc32_ext()`
consumed by disklabel64 and older HAMMER volumes.

**This pack proves two things:**

1. **Negative result with weight** — the primitives are bit-exact:
   `icrc32_diff` (userland, compiles the pristine kernel sources) passes
   21/21 checks: all 9 tables verified element-wise against bitwise-
   generated references (poly 0xEDB88320 / 0x82F63B78, sliced tables via
   the iterative slicing construction), KATs (`"123456789"` →
   `0xCBF43926` CRC-32, `0xE3069283` CRC-32C; empty → 0), functional
   equivalence of both engines for every length 0..600 × buffer alignment
   0..3, incremental-chaining semantics (incl. by-1/by-3 chunk churn),
   a 1 MiB random multitable-vs-bitwise comparison, and a PROT_NONE
   guard-page probe (256 boundary lengths × 3 entry points) that faults on
   any read past `p+length`. **No OOB read, no wrong CRC, no chaining
   hazard exists in the arithmetic.**

2. **The one real length-math defect (Info)** — the public API takes
   `size_t size` but `calculate_crc32c()` takes `unsigned int length`
   (`sys/libkern/icrc32.c:763`), so `iscsi_crc32(buf, 0x100000009ULL)`
   silently computes the CRC of 9 bytes (T10 in the harness;
   `fixdemo_baseline`). Every in-tree caller is bounded (dmsg aux is
   clamped to `DMSG_AUX_MAX` at `kern_dmsg.c:371-376`, swap ≤ MAXPHYS,
   hammer2 ≤ 64 KB radix), so this is a correctness-contract hazard /
   defense-in-depth item, not a reachable bug today.

## Reproduce

On the host (guest already up):

```sh
scp -F dfbsd-qemu/config -r findings/poc/DF-5679 dfbsd-maxx:/tmp/
dfbsd-qemu/vm.sh run_user 'sh /tmp/DF-5679/build.sh'   # build.log
dfbsd-qemu/vm.sh run_user 'sh /tmp/DF-5679/run.sh'     # run.log
```

`build.sh` copies `/usr/src/sys/libkern/{icrc32,crc32}.c` from the guest
tree (md5 `29e2ead0a146caec695a6804944e3cde` /
`7bb201c97ceb81fec180aaf9e9a9e445` — identical to the audited tree), builds
`icrc32_diff`, `fixdemo_baseline`, and `fixdemo_patched` (the latter from a
copy with `fix.diff` applied). `run.sh` runs all three.

## Expected output

- `RESULT: ALL-PASS (21 checks, 0 failures)` — primitives bit-exact, no OOB.
- `T10 ... TRUNCATED (equal)` — the filed defect, demonstrated.
- `FIX-BAD ... truncation still present` (baseline, exit 1) then
  `FIX-OK: length honored -> child faulted on guard page (sig 11)`
  (patched, exit 0) — fix validated.

## Artifacts

| file | what |
|---|---|
| `icrc32_diff.c` | differential/KAT/guard/truncation harness (code under test included verbatim) |
| `fixdemo.c` | fix-validation demo (baseline vs patched, guard-page fork test) |
| `fix.diff` | size_t end-to-end fix (icrc32.c + systm.h prototype), git-apply-able, never applied to `sys/` |
| `build.sh` / `run.sh` | exact runnable commands |
| `build.log` / `run.log` / `run.2.log` | full untrimmed compiler + runtime output |
| `fix_build.log` / `fix_run.log` | fix-validation build + run |
| `env.txt` | guest uname, compiler, md5 of code under test |
| `VERDICT.md` | full narrative |
| `manifest.json` / `verdict.json` | machine-readable catalog / verdict |