# PoC DF-1476: intel_gtt_insert_page swaps index/physical args to install_gtt_pte

**Class:** argument swap (HW misprogramming)
**Cited site:** `sys/dev/agp/intel-gtt.c:1411`

## Reproduction status

HW/module gated — **cannot be live-triggered on the audit QEMU guest.**

No — intel-gtt is part of the agp module and only meaningful on Intel integrated GPUs. The audit guest has no Intel IGD. Trigger requires an Intel IGD-bearing platform invoking intel_gtt_insert_page.

The bug is **confirmed at the source level** by tracing the cited path:line in
`sys/dev/agp/intel-gtt.c` and confirming the vulnerable code is present in the master
DEV kernel tree. The `fix.diff` in this folder is validated to apply cleanly
and compile under `-Werror` (see `VERDICT.md`).

## Mechanism

Line 1411 `sc->match->driver->install_gtt_pte(intel_agp, addr, pg, flags)`. The callback signature is `(device_t dev, u_int index, vm_offset_t physical, int flags)` (line 186). The sibling intel_gtt_insert_sg_entries at 1429 passes `(intel_agp, pg_start+i, page, flags)` — proving the parameter order is index,physical. At 1411 the args are swapped: addr (the dma_addr_t physical) is passed as index, and pg (the GTT index) is passed as physical. Result: GTT entries written at the wrong offsets with wrong physical page addresses.

## Realistic impact ceiling

logic/HW misprogramming

## Fix

Swap the args: `install_gtt_pte(intel_agp, pg, addr, flags)`.

See `fix.diff` for the git-apply-able patch.

## How to validate the fix

```
# 1. Apply fix.diff against the in-guest source:
scp -F dfbsd-qemu/config fix.diff dfbsd:/root/DF-1476.diff
ssh -F dfbsd-qemu/config dfbsd 'cd /usr/src && patch -p1 < /root/DF-1476.diff'

# 2. Rebuild the affected module (preferred) or a single-fix kernel:
ssh -F dfbsd-qemu/config dfbsd 'cd /usr/src/sys/sys/dev/agp && make'

# 3. The compile must succeed with -Werror (it does — see build.log).
```