lwkt_token_swap() lower-bound-only KKASSERTs: <2-token invocation corrupts memory before td_toks_array in non-INVARIANTS kernels

Summary

lwkt_token_swap() validates ref1/ref2 ≥ td_toks_base but never checks ref1 < td_toks_stop. Called with fewer than two held tokens, a production kernel computes ref1/ref2 at &td_toks_array[−1]/[−2] and executes the swap: writing array[−1].tr_tok/tr_count clobbers td_kfpuctx and td_toks_have, and the t_ref fixups dereference garbage and can repoint a genuinely-held token's exclusive ref outside the array (breaking mutual exclusion for all later acquisitions). All current callers are disciplined — defense-in-depth for future buggy callers, where the failure would be silent on production instead of a clean INVARIANTS panic.

Recommended fix

Add the missing upper-bound assertion and an early bail-out (if (ref2 < &td->td_toks_base) return;) — diff in the row above.

Timeline

• 2026-08-31 Discovered during pass-2 audit of lwkt_token.c (GLM 5.3).