# DF-1341 — VERDICT

**REPRODUCED at the function level** (impact: `dos`).

## Mechanism

r600_texture_size() at r600_cs.c:1418 computes 'unsigned nlevels = llevel - blevel + 1'. If blevel > llevel, nlevels wraps to ~4 billion. The for loop at :1426 iterates nlevels times computing per-level surface sizes. r600_check_texture_resource at :1580 only does dev_warn() and does NOT return -EINVAL. The MSAA path at :1542-1543 reads blevel from word4 then forces llevel = 0, so any user-supplied blevel > 0 (e.g. from a DRM command-submission ioctl with DRM_AUTH) triggers the wrap and a multi-minute spin per submission.

## Why not live-reproduced on the QEMU guest

AMD/ATI r600-era (Radeon HD 2xxx-4xxx) GPU absent from QEMU guest. radeon module loads only on matching HW. The bug fires on the command-submission validation path (DRM ioctl with DRM_AUTH — local authenticated user).

## Recommended fix

In r600_check_texture_resource, change the 'if (blevel > llevel) dev_warn(...)' block to also 'return -EINVAL'. This prevents the unsigned underflow in r600_texture_size.

## Kernel references (confirmed during verification)

- sys/dev/drm/radeon/r600_cs.c:1418 (nlevels = llevel - blevel + 1)
- sys/dev/drm/radeon/r600_cs.c:1426 (for-loop with nlevels iterations)
- sys/dev/drm/radeon/r600_cs.c:1542-1543 (MSAA path forces llevel = 0 after blevel is parsed)
- sys/dev/drm/radeon/r600_cs.c:1580 (only dev_warn, no return -EINVAL)

## Build/run

- Build harness: `cc -O2 -Wall -o trigger trigger.c`
- Run harness: `./trigger`
- Apply fix: `cd /usr/src && patch -p1 < fix.diff`
- Build single-fix kernel: `make -j6 nativekernel KERNCONF=X86_64_GENERIC`
  (validated — see `fix_build.log`; all 15 fixes compile cleanly in one batched
  build, rc=0).

## Tested kernels

- baseline: `DragonFly 6.5-DEVELOPMENT #0: Thu Jul  2 06:02:54 UTC 2026     root@dfbsd:/usr/obj/usr/src/sys/X86_64_GENERIC  x86_64`
- patched : `DragonFly 6.5-DEVELOPMENT #1: Mon Jul 20 21:51:01 UTC 2026     root@dfbsd:/usr/obj/usr/src/sys/X86_64_GENERIC  x86_64`