# DF-1298 / DF-1305 / DF-1314 / DF-1315 — hardware-gated driver findings

These four findings are kernel **driver/virtualization** bugs that are confirmed
real by source trace but that **cannot run on the QEMU audit guest** because the
required hardware is absent (see env.txt):

| Finding  | Subsystem | Required hardware            | Present on guest? |
|----------|-----------|------------------------------|-------------------|
| DF-1298  | amdgpu display VBIOS parser | AMD GPU (amdgpu) | NO (QEMU std-VGA only) |
| DF-1305  | radeon kv DPM               | AMD radeon KV APU | NO |
| DF-1314  | radeon btc/evergreen DPM    | AMD radeon NI GPU | NO |
| DF-1315  | nvmm AMD-SVM backend        | AMD-SVM CPU       | NO (guest CPU has no SVM bit) |

## Build
```
./build.sh
```
There is **no userspace PoC binary** to compile for these — the vulnerable code
is inside a kernel driver/VMM module that only executes when the relevant device
attaches or the SVM backend runs.  `build.sh` documents this.

## Run
```
./run.sh
```
`run.sh` performs a reachability check (`kldstat`, `pciconf`, `dmesg`) and
reports that the path is unreachable on this guest.  No panic/leak is expected
here because the trigger hardware is absent.

## Expected (bug present, on a host WITH the hardware)
Each VERDICT.md describes the exact trigger and the kernel-level effect
(heap overflow / OOB write / host DR7 persistence).  On this guest those are
**latent**.

## Reproduce the FIX validation
The fix for each is `fix.diff`.  To compile-validate a module fix:
1. `scp fix.diff` to the guest; `cd /usr/src && patch -p1 < fix.diff`
2. Build the relevant module, e.g.
   `cd /usr/src && make -j6 MODULES_OVERRIDE=... ` or a full
   `make -j6 nativekernel KERNCONF=X86_64_GENERIC` (which also builds modules).
3. Confirm the module/object compiles with no errors (see fix_build.log).

Runtime fix-behaviour cannot be compared on this guest because the PoC paths
are hardware-gated; the fix is therefore classified `not_testable` with a
compile + source-trace validation.