verify_dfa(9)

okay so this is verify_dfa(9) from the Kernel API Manual 💖 and we are about to vibe-check some tables. The assignment? Verify that transitions and states in the tables are in bounds. It’s giving “table babysitter with main character energy,” honestly. 🎀

✨ NAME ✨

verify_dfa — verify that transitions and states in the tables are in bounds. No cap, that’s the whole job. 💅

🌸 SYNOPSIS 🌸

int verify_dfa (const struct aa_dfa *dfa );

🦋 ARGUMENTS 🦋

• dfa — the dfa to test, and it is NOT NULL (do not come in here with a null dfa, bestie 💀).

💜 DESCRIPTION 💜

This function assumes dfa has gone through the first pass verification done by unpacking. So unpacking already did its little first-pass thing, and now verify_dfa is here for the bounds-check moment. Periodt. ✨

🔥 NOTE 🔥

Heads up, bestie: this does not valid accept table values. That’s the caveat — keep it in mind. 🙈

🌈 RETURN 🌈

Returns 0, else an error code on failure to verify. 😭

👑 SEE ALSO 👑

Kernel file ./security/apparmor/match.c and all these iconic little references:

• unpack_table(9)
• verify_table_headers(9)
• dfa_free(9)
• aa_dfa_free_kref(9)
• remap_data16_to_data32(9)
• aa_dfa_unpack(9)
• aa_dfa_match_len(9)
• aa_dfa_match(9)
• aa_dfa_next(9)
• aa_dfa_match_until(9)
• aa_dfa_matchn_until(9)
• aa_dfa_leftmatch(9)

mwah 💋 this page’s source/version is ./security/apparmor, dated October 2026, and it’s signed verify_dfa(9) 🫶