# F-031: kprobe perf oversized dynamic ustring buffer WARN panic

## Summary

Kprobe trace events can include dynamic `ustring` fetch arguments.  When such
an event is consumed through `perf_event_open(PERF_TYPE_TRACEPOINT)`, the
kprobe perf path computes the dynamic payload size and passes it to
`perf_trace_buf_alloc()`.  If the payload exceeds `PERF_MAX_TRACE_SIZE`, the
allocator emits `WARN_ONCE()`.

With `panic_on_warn=1`, this is a reproducible kernel panic.

## Relevant source

- `kernel/trace/trace_kprobe.c:1703`: computes dynamic data size for kprobe
  perf events.
- `kernel/trace/trace_kprobe.c:1708`: calls `perf_trace_buf_alloc(size, ...)`.
- `kernel/trace/trace_event_perf.c:405`: `WARN_ONCE(size > PERF_MAX_TRACE_SIZE, ...)`.

## Reproduction

Artifacts:

- `repro.c`: standalone PoC.
- `qemu.log`: validation log from `linux-7.0.9-work`.

Validation command:

```sh
timeout 90 qemu-system-x86_64 -m 1024M -smp 4 \
  -kernel linux-7.0.9-work/arch/x86/boot/bzImage \
  -initrd kprobe_perf_initramfs.cpio \
  -append "console=ttyS0 earlyprintk=serial nokaslr panic=-1 panic_on_warn=1 init=/init" \
  -nographic -no-reboot
```

Crash evidence:

```text
perf buffer not large enough, wanted 16420, have 8192
WARNING: kernel/trace/trace_event_perf.c:405 at perf_trace_buf_alloc+0x111/0x160
Kernel panic - not syncing: kernel: panic_on_warn set ...
```
