# DF-5727 — VERDICT

**reproduced** — **impact: none (mis-sized tripwire correctness defect; no
memory unsafety).**  The man-page-documented `watch addr[,size]` syntax
silently drops the size and always watches 4 bytes.

## Environment

Same rig as DF-5725 (stock `X86_64_GENERIC`, UP + SMP instances).

## Observation (exact)

```
db> watch ticks,8
db> show watches
 Map        Address  Size
*ffffffff8159eea0  ffffffff810529c8  4      <- requested 8, got 4
db> dwatch ticks
db> watch ticks 8
db> show watches
 Map        Address  Size
*ffffffff8159eea0  ffffffff810529c8  8      <- undocumented space form works
```

## Root cause (line-accurate)

`share/man/man4/ddb.4` (~line 495) documents `watch addr[,size]` ("The size
argument defaults to 4").  `db_command()`
(`sys/ddb/db_command.c:385-396`) parses `,size` into the command callback's
`count` parameter; `db_watchpoint_cmd()` (`sys/ddb/db_watch.c:192-205`)
ignores `count` and calls `db_expression(&value)` again — the token stream is
at end-of-line, `db_term()` returns FALSE (`sys/ddb/db_expr.c`), so
`size = 4` unconditionally.  Only the undocumented space-separated form
reaches a size.  `db_set_watchpoint()` (`db_watch.c:101-138`) then arms
`[addr, addr+4)` instead of the requested region, with no error.

Given DF-5721 (software watchpoints are inert on x86_64), this compounds the
dead-instrument problem with a distinct argument-handling root cause; it also
applies to any future arch where software watchpoints work.

## Fix validation

`fix.diff` (db_watch.c): honor the parser-provided `count` first, keep the
legacy space form, keep the 4 default.  On the combined-fix kernel
(`fix_run.log`):

```
db> watch ticks,8
db> show watches
 ... 8          <- comma syntax now honored
db> dwatch ticks
db> watch ticks
 ... 4          <- default preserved
```

Baseline reproduced / patched behavior corrected → **fixed**.

## Fix status (batch validation)
Applied with the 36 sibling fix.diffs of this batch in findings/poc/_batch41/all_fixes.patch; single in-guest `make -j6 nativekernel KERNCONF=X86_64_GENERIC` completed RC=0 with zero errors under -Werror (full log: findings/poc/_batch41/fix_build8.log). Behavior A/B intentionally skipped for this Info-tier item.