# DF-1483 — Integer overflow in user-fence offset check -> OOB GPU mem write (`amdgpu_cs.c`)

## Verdict: REPRODUCED (source-level + harness) — latent amdgpu-DRM bug, cross-process GPU memory corruption

## The bug

`sys/dev/drm/amd/amdgpu/amdgpu_cs.c`, function `amdgpu_cs_user_fence_chunk`,
lines 58-62:

```c
size = amdgpu_bo_size(bo);                          /* :58  PAGE_SIZE (4096) */
if (size != PAGE_SIZE || (data->offset + 8) > size) {   /* :59  32-bit add! */
    r = -EINVAL; ...
}
...
*offset = data->offset;                             /* :69  stored raw u32 */
```

`data->offset` is `__u32` (`drm_amdgpu_cs_chunk_fence.offset`,
`amdgpu_drm.h:588`). The addition `(data->offset + 8)` is performed in
**32-bit unsigned** arithmetic, so it WRAPS:

- `data->offset = 0xFFFFFFF8` -> `(0xFFFFFFF8 + 8) = 0x100000000 -> 0 (mod 2^32)`
- `0 > 4096` is false -> check PASSES
- `*offset = 0xFFFFFFF8`

Later: `job->uf_addr = (u64)0xFFFFFFF8` (`parser_init:234`);
`job->uf_addr += amdgpu_bo_gpu_offset(uf)` (`parser_bos:742`); the ring then
emits an 8-byte write at `uf_addr` (`amdgpu_ib.c:243`). Result: the GPU writes
8 bytes (a predictable fence sequence counter) ~4 GB past the `PAGE_SIZE`
fence BO into another process's VRAM/GTT BO or the GTT aperture. Reachable
from unprivileged `/dev/dri/renderDXX` (mode 0666). Upstream Linux uses 64-bit
math for this check.

## Harness proof

```
data->offset   | kernel-check | fixed-check | note
0xfffffff8     | PASS         | REJECT      | +8 wraps to 0 -> check PASSES (BUG)
0xffffffff     | PASS         | REJECT      | +8 wraps to 7 -> check PASSES (BUG)
final uf_addr  = 0x000000017ffffff8  <- GPU writes 8 bytes HERE
bytes past BO  = 4294967288 (~4 GB past PAGE_SIZE BO)
RESULT: integer-overflow bypass CONFIRMED at amdgpu_cs.c:59
```

The fixed check (cast `data->offset` to `u64` before the add) correctly
rejects every wrapping offset, proving the fix closes the bypass.

## Fix

`fix.diff` changes `(data->offset + 8)` to `((uint64_t)data->offset + 8)`,
matching upstream Linux.

## Module build validation (Phase 8)

All 8 amdgpu fixes applied; `amdgpu.ko` built under `-Werror`:
`amdgpu_cs.o` (25192 bytes) produced, 0 errors, `amdgpu.ko` linked.

**Note on impact:** unlike the other findings (which require a crafted VBIOS
on driver attach), this one is reachable at **runtime from an unprivileged
`renderDXX` fd** — the strongest threat model in this batch. The end-to-end
trigger needs AMD GPU HW + the amdgpu module, neither present on the guest;
the integer-overflow bypass itself is proven by the harness.