# PoC DF-1456: drm_mode_set_crtcinfo signed int overflow via unchecked vscan

**Class:** signed integer overflow (UB) / OOB
**Cited site:** `sys/dev/drm/drm_modes.c:1102-1130, 871-876`

## Reproduction status

HW/module gated — **cannot be live-triggered on the audit QEMU guest.**

No — the drm core is built into radeon/amdgpu/i915 modules; needs a DRM-capable GPU. No GPU in the audit guest. Trigger is an attacker-supplied drm_mode_modeinfo with vscan up to 65535.

The bug is **confirmed at the source level** by tracing the cited path:line in
`sys/dev/drm/drm_modes.c` and confirming the vulnerable code is present in the master
DEV kernel tree. The `fix.diff` in this folder is validated to apply cleanly
and compile under `-Werror` (see `VERDICT.md`).

## Mechanism

drm_mode_validate_basic (1102-1130) validates h/v timing ordering but NOT vscan. drm_mode_set_crtcinfo (871-876) multiplies crtc_vdisplay/crtc_vsync_start/crtc_vsync_end/crtc_vtotal by `p->vscan` (u16, up to 65535). vscan=65535 * vtotal>=32769 overflows signed int → undefined behavior; downstream CRTC math reads garbage.

## Realistic impact ceiling

corruption (DoS)

## Fix

In drm_mode_validate_basic, reject modes where `vscan > 1 && vscan > UINT_MAX / max(vtotal,1)`.

See `fix.diff` for the git-apply-able patch.

## How to validate the fix

```
# 1. Apply fix.diff against the in-guest source:
scp -F dfbsd-qemu/config fix.diff dfbsd:/root/DF-1456.diff
ssh -F dfbsd-qemu/config dfbsd 'cd /usr/src && patch -p1 < /root/DF-1456.diff'

# 2. Rebuild the affected module (preferred) or a single-fix kernel:
ssh -F dfbsd-qemu/config dfbsd 'cd /usr/src/sys/sys/dev/drm && make'

# 3. The compile must succeed with -Werror (it does — see build.log).
```