Check if member io_count is non-negative. If it is negative the cast to vm_size_t will fail. In that case return FALSE.
* device/dev_pager.c (device_pager_data_request_done): Check if member io_count is non-negative. (device_pager_data_request_done) (io_count): Cast to vm_size_t. --- device/dev_pager.c | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/device/dev_pager.c b/device/dev_pager.c index 35c79b3..a5dba3f 100644 --- a/device/dev_pager.c +++ b/device/dev_pager.c @@ -417,7 +417,10 @@ boolean_t device_pager_data_request_done(io_req_t ior) vm_size_t size_read; if (ior->io_error == D_SUCCESS) { - size_read = ior->io_count; + if (ior->io_count >= 0) + size_read = (vm_size_t)ior->io_count; + else + return FALSE; if (ior->io_residual) { if (device_pager_debug) printf("(device_pager)data_request_done: r: 0x%lx\n", ior->io_residual); -- 1.8.1.4