feat(mem): PMM 1GB-clamp + floor hardening, no-op at 128M (ADR-0021)

[NickFlach]

Summary

First increment of ADR-0021 (dynamic PMM sizing + 1 GB clamp), designed via an adversarial panel. This PR is the hardening groundwork — all changes are no-ops at the current hardcoded 128 MB, so it ships safely ahead of the mmap-driven sizing (PR-2/3/4).

The panel corrected the ADR's stale line refs and confirmed the work is small: the bitmap is already dynamic/self-sizing and boot.S already identity-maps the full 1 GB, so this is about the clamp + floor + overflow guards, not new allocation machinery.

Changes (kernel/src/memory.c, kernel/include/kernel/memory.h)

• PMM_PHYS_CEIL (0x40000000) / PMM_MAX_FRAMES (262144) — the 1 GB identity-map ceiling. A dedicated constant, deliberately not USER_VBASE (its equal value is incidental — a user-half relocation must not silently move the physical ceiling). pmm_init clamps total_frames to it before narrowing to uint32 and before sizing the bitmap, so every frame the allocator can hand out is provably mappable (a >= 1 GB frame is a HIGH: in_user_range validates the address range but not the page mapping — any ring-3 process can panic the kernel (DoS) #158-class escalation).
• Static-layout floor — if reported RAM is below the kernel heap's backing frames, pmm_init boot_panics instead of letting kheap_init build on unbacked memory.
• Guarded the kernel-image reservation loop with && i < total_frames (mirrors the heap loop), asserted the bitmap can't overrun the kernel region past 0x01100000, and widened the frame-address multiply to (uintptr_t)i * PAGE_SIZE (the clamp was the only thing preventing a 32-bit wrap in pmm_alloc_frame).

Verification

• WSL make BUILD_TYPE=debug clean (-Werror).
• make ci-smoke boots to QuantumOS ready with PMMROVER + PMMHEAP self-tests green — the changes are inert at 128 M.
• clang-format-18 / check-api-consistency.sh / cppcheck clean.

Next: PR-2 (synthetic clamp teeth-check), PR-3 (real mmap sizing), PR-4 (high-mem writeback proof + differential -m 256M/512M CI).

🤖 Generated with Claude Code