Enforce that content node distribution keys are in legal range

config-model/src/main/java/com/yahoo/vespa/model/content/ContentNode.java

@@ -37,6 +37,14 @@ public ContentNode(ModelContext.FeatureFlags featureFlags, TreeConfigProducer<?>
         rpc_num_targets = featureFlags.rpcNumTargets();
         rpc_events_before_wakeup = featureFlags.rpcEventsBeforeWakeup();
 
+        // <node>-level distribution key range validation is initially done through the XML schema,
+        // but we also check it here in the case of programmatic content node instantiations.
+        // Only [0, UINT16_MAX - 1] is a valid range. UINT16_MAX is a special content layer-internal
+        // sentinel value that must never be used by actual nodes.
+        if (distributionKey < 0 || distributionKey >= 65535) {
+            throw new IllegalArgumentException("Distribution key %d is outside valid range [0, 65534]".formatted(distributionKey));
+        }
+
         initialize();
         setProp("clustertype", "content");
         setProp("clustername", clusterName);

config-model/src/main/resources/schema/content.rnc

@@ -207,7 +207,7 @@ Documents = element documents {
 ContentNode = element node {
     GenericConfig* &
     service.attlist &
-    attribute distribution-key { xsd:nonNegativeInteger } &
+    attribute distribution-key { xsd:nonNegativeInteger { maxInclusive = "65534" } } &
     attribute capacity { xsd:double { minExclusive = "0.0" } }? &
     attribute mmap-core-limit { xsd:nonNegativeInteger }? &
     attribute core-on-oom { xsd:boolean }? &

config-model/src/test/java/com/yahoo/vespa/model/content/ContentClusterTest.java

@@ -54,6 +54,7 @@
 import static org.junit.jupiter.api.Assertions.assertNotNull;
 import static org.junit.jupiter.api.Assertions.assertNotSame;
 import static org.junit.jupiter.api.Assertions.assertNull;
+import static org.junit.jupiter.api.Assertions.assertThrows;
 import static org.junit.jupiter.api.Assertions.assertTrue;
 import static org.junit.jupiter.api.Assertions.fail;
 
@@ -1260,7 +1261,7 @@ private long resolveMaxTLSSize(Optional<Flavor> flavor) throws Exception {
     }
 
     @Test
-    void verifyt_max_tls_size() throws Exception {
+    void verify_max_tls_size() throws Exception {
         var flavor = new Flavor(new FlavorsConfig.Flavor(new FlavorsConfig.Flavor.Builder().name("test").minDiskAvailableGb(100)));
         assertEquals(21474836480L, resolveMaxTLSSize(Optional.empty()));
         assertEquals(2147483648L, resolveMaxTLSSize(Optional.of(flavor)));
@@ -1487,6 +1488,24 @@ void distributor_operation_cancelling_config_controlled_by_properties() throws E
         assertTrue(resolveDistributorOperationCancellationConfig(2));
     }
 
+    @Test
+    void node_distribution_key_outside_legal_range_is_disallowed() {
+        // Only [0, UINT16_MAX - 1] is a valid range. UINT16_MAX is a special content layer-internal
+        // sentinel value that must never be used by actual nodes.
+        for (int distKey : List.of(-1, 65535, 65536, 100000)) {
+            assertThrows(IllegalArgumentException.class, () ->
+                    parse("""
+                            <content version="1.0" id="storage">
+                              <documents/>
+                              <redundancy>1</redundancy>
+                              <group>
+                                <node hostalias='mockhost' distribution-key='%d' />
+                              </group>
+                            </content>""".formatted(distKey)
+                        ));
+        }
+    }
+
     private String servicesWithGroups(int groupCount, double minGroupUpRatio) {
         String services = String.format("<?xml version='1.0' encoding='UTF-8' ?>" +
                 "<services version='1.0'>" +