# DF-1332 — VERDICT

**REPRODUCED at the function level** (impact: `leak`).

## Mechanism

amdgpu_fill_buffer() at amdgpu_ttm.c:2183 declares 'uint32_t byte_count = mm_node->size << PAGE_SHIFT'. For an mm_node with size >= 2^20 (4 GiB of pages), the shift truncates to 0. DIV_ROUND_UP(0, max_bytes) = 0, so num_loops stays 0 and the SDMA fill never executes. The AMDGPU_GEM_CREATE_VRAM_CLEARED flag (set by unprivileged render clients via amdgpu_gem.c:226) is silently defeated: freshly allocated VRAM contains the stale contents of previously freed buffer objects. On a shared GPU this is cross-user disclosure of render frames, textures, or crypto material.

## Why not live-reproduced on the QEMU guest

AMD GPU absent from QEMU guest. The amdgpu module loads only on matching HW. The bug fires at BO-allocation / VRAM-clear time when an unprivileged render client requests a large BO, which requires a real AMD GPU.

## Recommended fix

Make byte_count uint64_t in both while-loops of amdgpu_fill_buffer. Compute num_loops and cur_size_in_bytes from the untruncated value so that the SDMA fill runs for all bytes (using chunked max_bytes writes inside the inner while).

## Kernel references (confirmed during verification)

- sys/dev/drm/amd/amdgpu/amdgpu_ttm.c:2183 (uint32_t byte_count = mm_node->size << PAGE_SHIFT)
- sys/dev/drm/amd/amdgpu/amdgpu_ttm.c:2185 (DIV_ROUND_UP(byte_count, max_bytes) = 0)
- sys/dev/drm/amd/amdgpu/amdgpu_ttm.c:2211 (second occurrence; same truncation in the fill loop)

## Build/run

- Build harness: `cc -O2 -Wall -o trigger trigger.c`
- Run harness: `./trigger`
- Apply fix: `cd /usr/src && patch -p1 < fix.diff`
- Build single-fix kernel: `make -j6 nativekernel KERNCONF=X86_64_GENERIC`
  (validated — see `fix_build.log`; all 15 fixes compile cleanly in one batched
  build, rc=0).

## Tested kernels

- baseline: `DragonFly 6.5-DEVELOPMENT #0: Thu Jul  2 06:02:54 UTC 2026     root@dfbsd:/usr/obj/usr/src/sys/X86_64_GENERIC  x86_64`
- patched : `DragonFly 6.5-DEVELOPMENT #1: Mon Jul 20 21:51:01 UTC 2026     root@dfbsd:/usr/obj/usr/src/sys/X86_64_GENERIC  x86_64`