# PoC DF-1492: r300_packet3_check missing per-opcode minimum COUNT

**Class:** IB OOB read
**Cited site:** `sys/dev/drm/radeon/r300.c:1166-1248`

## Reproduction status

HW/module gated — **cannot be live-triggered on the audit QEMU guest.**

No — radeon DRM HW-gated. Trigger is a CS IB ending with a packet3 (INDX_BUFFER/DRAW_*) of COUNT=0.

The bug is **confirmed at the source level** by tracing the cited path:line in
`sys/dev/drm/radeon/r300.c` and confirming the vulnerable code is present in the master
DEV kernel tree. The `fix.diff` in this folder is validated to apply cleanly
and compile under `-Werror` (see `VERDICT.md`).

## Mechanism

r300.c:1176 `idx = pkt->idx + 1;`. Several opcodes (PACKET3_INDX_BUFFER :1191, _3D_DRAW_IMMD :1202, _3D_DRAW_VBUF :1229, _3D_DRAW_INDX :1243) read `ib[idx+1]` without checking pkt->count. The parser radeon_cs.c:768 accepts a packet when `(pkt->count+1+pkt->idx) < length_dw`, so a COUNT=0 packet at end of IB has idx+1 == length_dw → ib[idx+1] reads past the IB allocation.

## Realistic impact ceiling

leak (info leak / DoS)

## Fix

Reject packets with `pkt->count < 1` at the top of r300_packet3_check (after the idx assignment).

See `fix.diff` for the git-apply-able patch.

## How to validate the fix

```
# 1. Apply fix.diff against the in-guest source:
scp -F dfbsd-qemu/config fix.diff dfbsd:/root/DF-1492.diff
ssh -F dfbsd-qemu/config dfbsd 'cd /usr/src && patch -p1 < /root/DF-1492.diff'

# 2. Rebuild the affected module (preferred) or a single-fix kernel:
ssh -F dfbsd-qemu/config dfbsd 'cd /usr/src/sys/sys/dev/drm/radeon && make'

# 3. The compile must succeed with -Werror (it does — see build.log).
```