RB tree engine has zero INVARIANTS-mode structural validation, and scan_info_done walks the inprog list without a termination guard

Summary

The engine compiled by RB_GENERATE contains no assertion of any kind, even on INVARIANTS kernels: no red/black property check, no parent-child reciprocity check, no BST-order check on insert/remove, and no cycle guard in RB_SCAN's successor walk. The DF-2924 quota-walk cycle (a consumer-side unsynchronization corrupting an RB tree built on this engine) therefore manifests as an unbounded wild pointer chase through kernel memory rather than an immediate, diagnosable panic — a corrupted pm_pvroot or swblock_root behaves the same way. Additionally, name##_scan_info_done walks the singly-linked inprog list with while (*infopp != scan) and no NULL exit; any prior corruption of RB_INPROG turns unlink into an unkillable traversal of arbitrary memory instead of a clean panic. Not directly attacker-triggerable: degrades detectability/containment of consumer-side bugs. Fix: INVARIANTS/DEBUG-gated validator (parent reciprocity, BST order, black-height, color domain) invoked from INSERT/REMOVE, bounded-steps guard on RB_SCAN, NULL-terminated walk + KKASSERT in scan_info_done (row diff).

Timeline

• 2026-09-02 Discovered during pass-2 audit of subr_rbtree.c (GLM 5.3).