In the Linux kernel, the following vulnerability has been resolved:

cifs: fix loff t underflow in cifs remap file range() when len == 0

With len == 0 (clone to EOF), the effective length is computed as:

len = src inode->i size - off;

If off > i size, this is a negative loff t, corrupting the ByteCount in the FSCTL DUPLICATE EXTENTS TO FILE request and inverting the range in filemap write and wait range(). The existing off >= i size check fires only after the ioctl has already been sent.

Snapshot i size read() once for both the bounds check and the length calculation, eliminating the TOCTOU and 32-bit torn-read risk. Reject off > src size with -EINVAL. Treat off == src size as a no-op, consistent with generic remap file range prep().