# PoC DF-1516: intel_overlay.c u32 integer overflow in offset bounds check

**Class:** Integer overflow -> bounds check bypass -> OOB GPU read
**Cited site:** `sys/dev/drm/i915/intel_overlay.c:1033-1051`

## Reproduction status

HW/module gated — **cannot be live-triggered on the audit QEMU guest.**

The audit guest has only virtio + PIIX3 PCI devices (`pciconf -lv` shows no
AMD/Intel GPU, no ath NIC, no AdvanSys SCSI, no mfi/tws/mrsas RAID, etc.),
so the cited code path is not reachable at runtime on this guest.

The bug is **confirmed at the source level** by tracing the cited path:line
in `sys/dev/drm/i915/intel_overlay.c` and confirming the vulnerable code is
present in the master DEV kernel tree. The `fix.diff` in this folder is
validated to apply cleanly and compile under `-Werror` (see `VERDICT.md`).

## Mechanism

check_overlay_src computes tmp = rec->stride_Y * rec->src_height (both u32) then rec->offset_Y + tmp > new_bo->base.size. Both additions are u32 and silently wrap mod 2^32; the wrapped value compared as u64 against size_t passes the check. The packed (line 1033), planar Y (1044-1045) and planar UV (1049-1050) sites all have the same flaw.

## Realistic impact ceiling (on suitable HW)

GPU memory OOB read / cross-buffer leak via crafted DRM overlay params

## Fix

Compute stride*height and offset+tmp as uint64_t in all three sites.

See `fix.diff` for the git-apply-able patch.

## How to validate the fix

```sh
scp -F dfbsd-qemu/config fix.diff dfbsd:/root/DF-1516.diff
ssh -F dfbsd-qemu/config dfbsd 'cd /usr/src && patch -p1 --forward < /root/DF-1516.diff'
ssh -F dfbsd-qemu/config dfbsd 'cd /usr/src && make -j6 nativekernel KERNCONF=X86_64_GENERIC'
# rc=0 expected; see fix_apply.log + fix_build.log in this folder.
```