# DF-5710 — smbfs_mount: `pe - pc - 2` can be −1 → `strncpy(dst, src, (size_t)-1)` → unbounded kernel heap copy

- **File (audit target):** `sys/libkern/strncpy.c` (pass 2, consumer census)
- **Defect location:** `sys/vfs/smbfs/smbfs_vfsops.c:170-176` (`smbfs_mount`)
- **Severity:** Medium (kernel memory corruption; trigger requires mount-time
  privilege + an established SMB session — Dillon legacy bucket)
- **Confidence:** certain (arithmetic verified against real struct sizes;
  reproduced with the guest kernel's own `strncpy.c` under guard pages)

## Reproduce

On the audit QEMU guest (DF 6.5-DEVELOPMENT), with the rig transferred to
`/tmp/rig` (see `build.sh`; the kernel file is compiled **unmodified** from
`/usr/src/sys/libkern/strncpy.c`):

```
./build.sh && ./run.sh
```

Expected (decisive lines):

```
[case1 user-route] after user+'@': pc offset=143 budget2=-1
  -> result: SIGSEGV (write crossed guard page)  [user-route guard]
[case2 share-route] after srv+'/': pc offset=143 budget3=-1 (share='pub')
  -> result: SIGSEGV (write crossed guard page)  [share-route guard]
```

and, with the fixed caller (`./harness_smbfs_fixed`), the same inputs:

```
  -> result: clean exit(0)   (every case, f_mntfromname NUL-terminated)
```

## What the rig contains

| file | purpose |
|---|---|
| `harness_strncpy.c` | the audited file itself: differential vs libc (matrix + 100k fuzz), pad-count math (exactly-n canary proof), guard-page src/dst bounds. **All pass — the implementation is clean; the bug is at the caller.** |
| `harness_smbfs.c` | verbatim caller code from `smbfs_vfsops.c:165-178` with real sizes (`MNAMELEN=80`), guard-paged mount-struct analogue, 4 cases |
| `harness_smbfs_fixed.c` | same rig with the `pe - pc > 2` guards from `fix.diff` — fix validation |
| `harness_netmap_clamp.c` | DF-5711 evidence (shared rig) |
| `shim/sys/libkern.h` | minimal shim so the kernel file compiles unmodified |
| `fix.diff` | the smbfs fix (applies clean to guest `/usr/src`; module builds with `-Werror`) |
| `fix_netmap.diff` | the DF-5711 fix (applies clean) |