# PoC DF-1467: vi_get_register_value OOB read of rb_config[se][sh]

**Class:** kernel struct OOB read (info leak)
**Cited site:** `sys/dev/drm/amd/amdgpu/vi.c:550-568`

## Reproduction status

HW/module gated — **cannot be live-triggered on the audit QEMU guest.**

No — amdgpu is a loadable module and only attaches to AMD GPUs (Tonga/Fiji/Polaris etc.). No AMD GPU in the audit guest. Trigger is AMDGPU_INFO_READ_MMR_REG ioctl with se/sh in 0..254 (the masked range excludes only 0xff).

The bug is **confirmed at the source level** by tracing the cited path:line in
`sys/dev/drm/amd/amdgpu/vi.c` and confirming the vulnerable code is present in the master
DEV kernel tree. The `fix.diff` in this folder is validated to apply cleanly
and compile under `-Werror` (see `VERDICT.md`).

## Mechanism

vi.c:556-557 `se_idx = se_num==0xffffffff ? 0 : se_num; sh_idx = ...;` where se_num/sh_num come from user ioctl masked to 0..254 (amdgpu_kms.c:654-659). Lines 561-567 index `adev->gfx.config.rb_config[se_idx][sh_idx]` which is sized `[AMDGPU_GFX_MAX_SE=4][AMDGPU_GFX_MAX_SH_PER_SE=2]` (amdgpu_gfx.h:179). se_idx>=4 or sh_idx>=2 reads ~12KB past the array into the amdgpu_gfx struct (kernel pointers). DRM_AUTH|DRM_RENDER_ALLOW gated but reachable by any DRM client.

## Realistic impact ceiling

leak (info leak, KASLR bypass)

## Fix

Add `if (se_idx >= AMDGPU_GFX_MAX_SE || sh_idx >= AMDGPU_GFX_MAX_SH_PER_SE) return 0;` before the switch.

See `fix.diff` for the git-apply-able patch.

## How to validate the fix

```
# 1. Apply fix.diff against the in-guest source:
scp -F dfbsd-qemu/config fix.diff dfbsd:/root/DF-1467.diff
ssh -F dfbsd-qemu/config dfbsd 'cd /usr/src && patch -p1 < /root/DF-1467.diff'

# 2. Rebuild the affected module (preferred) or a single-fix kernel:
ssh -F dfbsd-qemu/config dfbsd 'cd /usr/src/sys/sys/dev/drm/amd/amdgpu && make'

# 3. The compile must succeed with -Werror (it does — see build.log).
```