Summary

dma_fence_array_create computes allocation size as sizeof(*array) + num_fences * sizeof(struct dma_fence_array_cb) with no validation of num_fences (signed int) and no overflow check on multiply (fence-array.c:173-177). Negative num_fences e.g. -1: (size_t)(-1)=0xFFFFFFFFFFFFFFFF multiplied by sizeof(cb)=32 wraps to SIZE_MAX-31; adding sizeof(*array)>=200 wraps total to sizeof(*array)-32 small positive; kzalloc succeeds ~170 bytes; line 186 array->num_fences=num_fences stores (unsigned)(-1)=UINT_MAX. Loop at :92 for(i=0;i<array->num_fences;++i) cb[i].array=array writes UINT_MAX entries past allocation = catastrophic heap OOB write. Release loop at :131 likewise reads array->fences[i] OOB. DragonFly kzalloc/kmalloc no overflow detection no check_mul_overflow helper in LinuxKPI headers. EXPORT_SYMBOL callable by any kernel module. Currently NOT reachable: 3 in-tree callers all pass small bounded unsigned values (amdgpu_ids.c:135 count from reservation_object_get_fences_rcu; amdgpu_ids.c:239 i bounded by id_mgr->num_ids HW-limited; amdgpu_prime.c:221 dead code #if 0). Latent defense-in-depth: function performs zero input validation on exported API.