tmpfs_reg_resize shrink path: 'aobj->size = osize;' self-assignment dead store — swap-object size never reduced after truncate (intended aobj->size = nsize), live upstream

Summary

In tmpfs_reg_resize's shrink branch, osize is loaded from aobj->size (:1055), and the 'resize' assignment at :1058 writes osize back - a no-op self-assignment. The surrounding cleanup (swap_pager_freespace(aobj, nsize, osize-nsize), vm_object_page_remove(aobj, nsize, osize)) clearly intends to shrink the swap-backed object's coverage to nsize, and the grow path resynchronizes it unconditionally (:1088). Because of the dead store, aobj->size remains at the old high-water mark until the next grow. Line identical in DragonFlyBSD master - live upstream. Impact-audited benign in the current call graph (vm_page_rename does not bound-check; swap_pager_freespace idempotent; no path inserts pages beyond nsize; later ranges use the same stale value so cleanup stays consistent; deallocate frees the whole memq regardless). Security-relevant only as a latent trap: any future consumer trusting aobj->size to bound valid swap assignments inherits a lie after every truncate. Not userland-observable; Phase V skipped (Low). Fix: aobj->size = nsize.