# DF-1408 — Verification Verdict

## Verdict: CONFIRMED-BY-SOURCE-TRACE (HW-gated)

**Status:** inconclusive (HW-gated / not reachable as unprivileged maxx)
**Impact:** none (cannot reproduce on QEMU guest — no GPU/HW, or root/operator-only)
**Confidence:** certain (source-trace confirmed bug is real)

## Mechanism

Multiple ATOM parsers compute num_indices=(size-sizeof(HEADER))/sizeof(ENTRY) from BIOS u16 size. Underflow when size<HEADER → huge num_indices (unsigned division). Locations: lookup_i2c_gpio (:106), lookup_gpio (:177), get_asic_ss_info (:926/945/967 for SS_ASSIGNMENT V1/V2/V3). get_leakage_vddc (:1326-1331) iterates j*ucElbVDDC_Num+i up to 65535. All read past BIOS kmalloc into kernel heap. Crafted VBIOS triggers OOB reads.

**Source:** `sys/dev/drm/amd/amdgpu/amdgpu_atombios.c:106, 177, 926/945/967, 1326-1331, 375/389`

## Why it cannot be reproduced on this guest

HW-gated. amdgpu.ko requires AMD GPU hardware. No GPU in QEMU guest.

## Phase 6: Escalation Assessment

This is a **HW-gated GPU module (amdgpu ATOM BIOS parser)** finding. The primitive is not reachable from the
unprivileged maxx user on this guest (no hardware / module not loaded / root-only device).
No escalation chain is possible because the trigger path is not exercisable.

For GPU findings: the module (radeon.ko/amdgpu.ko/i915.ko) is a loadable module not
present in the GENERIC kernel and requires actual GPU hardware absent from the QEMU guest.
For root/operator findings: the device node is mode 0600 or 0640 root:operator, and maxx
(uid 1001) has no operator group membership.

## Fix

Check size >= sizeof(HEADER) before computing num_indices at all five locations. Return early (with safe default) if underflow would occur.

**Fix description:** Add size >= sizeof(ATOM_COMMON_TABLE_HEADER) guard before each num_indices computation.

The full git-apply-able diff is in `fix.diff`. It applies cleanly to the audit source tree
and compiles as part of the kernel build (validated via `make nativekernel` rc=0).

## Classification

- **status:** inconclusive
- **reproduced:** 0
- **impact:** none
- **fix_status:** not_testable (HW-gated: PoC cannot run on guest; diff applies + compiles verified)