rman_reserve_resource window arithmetic wraps when count-1 > end: allocation escapes the caller's [start,end] window (and can produce an inverted r_end < r_start node when start+count-1 overflows)

Summary

Sibling of DF-0090 (count==0) with a different input class: when count−1 > end, the scan-break s->r_start > end − (count−1) wraps and never fires, and ulmax(start + count − 1, end) lets rend exceed the caller's end, so rv->r_end = rstart + count − 1 is granted BEYOND the requested window (violating the documented contract — e.g. a PCI bridge window can be exceeded, mapping MMIO outside the programmed window). If start+count−1 additionally wraps ULONG_MAX, an inverted r_end < r_start node results. Driver-bug/firmware-gated (no in-tree caller passes count>end+1). Distinct from DF-2853 (no alignment involved).

Recommended fix

Validate the request window once at entry (subsumes DF-0090): if (count == 0 || end < start || start + count - 1 < start || end - (count - 1) > end) return (NULL); — row diff above.

Timeline

• 2026-09-02 Discovered during pass-2 audit of subr_rman.c (GLM 5.3).