# Read-only block geometry contract (K1501–K1505)

The device capacity is a nonzero number of 512-byte sectors. Converting it
to bytes must not overflow `u64`. A read has a nonzero sector count, and both
`first_lba + count` and the byte offsets use checked arithmetic. The end is
exclusive and must be within device capacity. LBA zero and the last complete
sector are valid. A range ending one sector beyond capacity or overflowing
the LBA sum is rejected before any descriptor or avail entry is published.

The geometry model is pure and owns no DMA buffer. The caller owns request
frames until a valid completion or an observed device reset. Local tests cover
both boundaries and rejected ranges; K1505 must observe first and last sector
reads and refused out-of-range publication in direct and UEFI guests.