Summary

dma_fence_default_wait (linux_fence.c:124-151): end=jiffies+timeout (unsigned long at 124); loop "for(ret=timeout;ret>0;ret=MAX(0,end-jiffies))" at 125. jiffies==ticks unsigned long (jiffies.h:42). When deadline passes end-jiffies wraps to ~ULONG_MAX; MAX(0,ULONG) (sys/param.h:430) promotes literal 0 to unsigned long returns huge value; storing in "long ret" makes ret negative. Loop guard ret>0 exits; line 151 "return ret" propagates negative. dma_fence contract: ret==0 timeout ret<0 error -- legitimate timeout indistinguishable from real error. Upstream Linux uses schedule_timeout() clamping >=0; DragonFly shim uses lksleep() returning EWOULDBLOCK not remaining-jiffies. Reachable from unprivileged render clients: DRM_IOCTL_AMDGPU_WAIT_CS (amdgpu_cs.c:1367) calls dma_fence_wait_timeout(fence,true,timeout) with user-controlled timeout; amdgpu_cs.c:1375 "if(r<0)return r" returns spurious negative errno instead of timeout status. Also corrupts internal timeout bookkeeping in reservation_object_wait_timeout_rcu (linux_reservation.c:490) where dma_fence_wait_timeout timeout<0 guard (56) turns it into -EINVAL. No memory corruption or privilege change; wrong error semantics / spurious error reporting / potential retry/abort misbehavior. AV:L/PR:L/AC:L, I:L/A:L. Fix: clamp ret>=0 before return and compute remainder via time_after_eq signed comparison.