# DF-1130 — radeon/si.c firmware loader OOB heap read

## TL;DR
- **Status: REPRODUCED (source + harness).** Three SI microcode loaders
  consume firmware header offset/size fields without bounds-checking them
  against `fw->datasize`. `radeon_ucode_validate` only checks
  `datasize == size_bytes`, so a crafted firmware with mismatched payload
  offset/size causes an arbitrary-length OOB heap read.
- **Impact: panic / DoS** (read-only primitive; the OOB u32s are written
  to GPU MMIO registers, not returned to userspace — primary realistic
  outcome is a page-fault panic during boot/resume microcode load).

## Why no live trigger on this guest
Bug is in `radeon.ko`. The QEMU audit guest has no AMD GPU, so `radeon.ko`
is never `kldload`ed. Trigger requires SI hardware + a crafted firmware
blob (or a malicious VBIOS).

## Files
- `harness.c` — userspace harness simulating the crafted firmware and
  validating both buggy and fixed loader logic.
- `fix.diff` — adds `offset + size <= datasize` checks in
  `si_mc_load_microcode`, `si_cp_load_microcode`, `si_rlc_resume`.
- `run.log`, `env.txt`.

## Reproduce
```
./build.sh && ./run.sh
```
Expected: harness shows `radeon_ucode_validate` accepting the crafted
firmware, the buggy loader computing a 19,440-byte OOB read, and the
fixed loader rejecting with `-EINVAL`.

## Fix validation
`fix.diff` applied to `/usr/src`; `radeon.ko` rebuilt cleanly (2,029,288
bytes). See VERDICT.md.