From aee3a638ee940c9d06ccb3c0127d6c36d068cd6c Mon Sep 17 00:00:00 2001
From: Nicholas Dudfield <ndudfield@gmail.com>
Date: Fri, 26 Jun 2026 10:26:47 +0700
Subject: [PATCH] fix(consensus): avoid NegativeUNL cap overflow

---
 src/test/consensus/NegativeUNL_test.cpp | 7 +++++++
 src/xrpld/app/misc/NegativeUNLVote.h    | 4 ++--
 2 files changed, 9 insertions(+), 2 deletions(-)

diff --git a/src/test/consensus/NegativeUNL_test.cpp b/src/test/consensus/NegativeUNL_test.cpp
index 2f865c183..af36cc1d2 100644
--- a/src/test/consensus/NegativeUNL_test.cpp
+++ b/src/test/consensus/NegativeUNL_test.cpp
@@ -27,6 +27,8 @@
 #include <xrpl/basics/Log.h>
 #include <xrpl/beast/unit_test.h>
 
+#include <limits>
+
 namespace ripple {
 namespace test {
 
@@ -1625,6 +1627,11 @@ class NegativeUNLVoteMaxListed_test : public beast::unit_test::suite
         BEAST_EXPECT(NegativeUNLVote::maxNegativeUNLListed(8) == 2);
         BEAST_EXPECT(NegativeUNLVote::maxNegativeUNLListed(9) == 3);
         BEAST_EXPECT(NegativeUNLVote::maxNegativeUNLListed(32) == 8);
+
+        auto const max = std::numeric_limits<std::size_t>::max();
+        BEAST_EXPECT(
+            NegativeUNLVote::maxNegativeUNLListed(max) ==
+            max / NegativeUNLVote::negativeUNLMaxListedDenominator + 1);
     }
 
     void
diff --git a/src/xrpld/app/misc/NegativeUNLVote.h b/src/xrpld/app/misc/NegativeUNLVote.h
index 6bf9f47b2..b388a66e9 100644
--- a/src/xrpld/app/misc/NegativeUNLVote.h
+++ b/src/xrpld/app/misc/NegativeUNLVote.h
@@ -84,8 +84,8 @@ public:
     static constexpr size_t
     maxNegativeUNLListed(size_t unlSize)
     {
-        return (unlSize + negativeUNLMaxListedDenominator - 1) /
-            negativeUNLMaxListedDenominator;
+        return unlSize / negativeUNLMaxListedDenominator +
+            (unlSize % negativeUNLMaxListedDenominator == 0 ? 0 : 1);
     }
 
     /**