kiblnd_setup_rd_kiov():

fragnob = min((int)(kiov->bv_len - offset), nob);
if ((fragnob < (int)(kiov->bv_len - offset)) &&
nkiov < max_nkiov && nob > fragnob) {

Let A = (int)(kiov->bv_len - offset); fragnob = min(A, nob);. There are two cases:

1. A < nob

• fragnob = A

• if ((A < A) && ... -> False

1. nob < A

• fragnob = nob

• if ((nob < A) && nkiov < max_nkiov && nob > nob) -> False

The two clauses can never both hold. tx->tx_gaps = true exists in exactly one place (and that place is unreachable, so tx_gaps is permanently false.

This means all downstream gap handling is dead:

• -EPROTONOSUPPORT preemptive guard

• FMR -EFBIG guard

• FMR multi-fragment gap path (else branch)

Gapped bulk transfers are never detected and never diverted; they fall through to ib_map_mr_sg, which short-maps and returns -EINVAL.