# DF-5838 — VERDICT

**status: untested (deliberately not executed — latent contract defect, no reachable trigger in this tree)**
**impact: none demonstrated (latent on-disk-corruption footgun)**
**confidence: certain (code discrepancy), speculative (impact until a mismatching caller exists)**

## Static verification (line-accurate)

1. `sys/kern/vfs_cluster.c:1746-1748` — `getcacheblk(vp, loffset,
   last_bp->b_bcount, GETBLK_SZMATCH|GETBLK_NOWAIT)`: SZMATCH compares the
   pre-existing buffer's `b_bcount` against `last_bp->b_bcount`
   (`sys/kern/vfs_bio.c:2799-2802`), *not* `blksize`.
2. The documented contract at `sys/kern/vfs_cluster.c:1719-1721` ("Only
   pre-existing buffers whos block size matches blksize are collected") and
   every other computation in the function/callers uses `blksize`:
   `len` (`:1737`), stride (`:1745`), `cluster_write`'s `endbp` and
   realloc teardown (`:1312-1342`).
3. Downstream consumer `ffs_reallocblks` assumes one fs_bsize block per
   child: block-map rewrite loop `sys/vfs/ufs/ffs_alloc.c:470-497` and the
   old-block free `ffs_blkfree(..., fs->fs_bsize)` at `ffs_alloc.c:535-541`.
   A mixed-size children list frees fragment-backed blocks as full blocks →
   allocation-bitmap corruption. The guards that would catch it
   (`ffs_alloc.c:375-388`) are `#ifdef DIAGNOSTIC`.
4. Caller sweep confirms no current caller passes `bp->b_bcount != blksize`:
   - UFS full-block-only gate `sys/vfs/ufs/ufs_readwrite.c:377-380`;
   - HAMMER1 `sys/vfs/hammer/hammer_vnops.c:841`;
   - HAMMER2 `sys/vfs/hammer2/hammer2_vnops.c:1177`;
   - tmpfs `sys/vfs/tmpfs/tmpfs_vnops.c:864-881`;
   - the only other cluster_write path, `cluster_awrite` → `cluster_wbuild`,
     never reaches `cluster_collectbufs`.

## Why not executed on the guest

No trigger exists: the mismatch requires a future/unknown filesystem caller
passing a short or oversized buffer. An unprivileged user cannot influence
`bp->b_bcount` vs the `blksize` argument independently — both are fixed by
the filesystem per write. Guest left untouched.

## Recommended fix

`fix.diff`: `last_bp->b_bcount` → `blksize` at `sys/kern/vfs_cluster.c:1747`.
One line; aligns the collection filter with the documented contract and the
surrounding arithmetic. Not built (behavior is identical for every existing
caller; `fix_status: not_testable`).

## Fix status (batch validation)
Applied with the 36 sibling fix.diffs of this batch in findings/poc/_batch41/all_fixes.patch; single in-guest `make -j6 nativekernel KERNCONF=X86_64_GENERIC` completed RC=0 with zero errors under -Werror (full log: findings/poc/_batch41/fix_build8.log). Behavior A/B intentionally skipped for this Info-tier item.