Summary

dm_target_linear_init accepts any uint64_t offset from atoi64(argv[1]) (line 75) and never checks that offset+table_en->length fits inside underlying pdev. atoi64 (device-mapper.c:583) silently wraps past 2^64 so operator-supplied offset >=2^55 sectors makes tlc->offset*DEV_BSIZE in strategy (114) and dump (129) overflow to small/negative byte offset. dm device then maps delegated user I/O onto unintended region of underlying physical device defeating linear target slice confinement. Linux dm-linear (dm_linear_ctr) validates exactly this; BSD port omits check entirely. dm_table_load_ioctl (dm_ioctl.c:750-753) reads table_en->start/length from proplib no validation; dm_table_init only splits argv so target init is sole place check can live and has none. dmstrategy bounds_check_with_mediasize (device-mapper.c:399-405) only bounds I/O against dm device OWN reported size never against underlying pdev capacity. Underlying disk driver bounds_check_with_mediasize only catches offsets PAST media end not wrapped-small offset pointing at wrong data. Preconditions: operator-group access /dev/mapper/control (mode 0640 root:operator). Attack: root/operator creates dm-linear device intended to expose ONLY a slice of disk to less-privileged user (dm node chowned to user) but supplies/wraps offset whose byte form lands inside [0 pdev_size). Less-privileged user reads/writes sectors of physical device admin never intended to expose confidentiality+integrity break.