# PoC DF-1527: i915_request postfix uninitialized on RCU-reuse

**Class:** Use of uninitialized value (stale slab data)
**Cited site:** `sys/dev/drm/i915/i915_request.c:786-791, 1082, 1033-1037`

## Reproduction status

HW/module gated — **cannot be live-triggered on the audit QEMU guest.**

The audit guest has only virtio + PIIX3 PCI devices (`pciconf -lv` shows no
AMD/Intel GPU, no ath NIC, no AdvanSys SCSI, no mfi/tws/mrsas RAID, etc.),
so the cited code path is not reachable at runtime on this guest.

The bug is **confirmed at the source level** by tracing the cited path:line
in `sys/dev/drm/i915/i915_request.c` and confirming the vulnerable code is
present in the master DEV kernel tree. The `fix.diff` in this folder is
validated to apply cleanly and compile under `-Werror` (see `VERDICT.md`).

## Mechanism

i915_request_alloc hand-clears global_seqno/signaling.wait.seqno/file_priv/batch/capture_list but OMITS postfix (comment: Do not use kmem_cache_zalloc). Request slab is SLAB_TYPESAFE_BY_RCU, NOT zeroed on realloc. postfix is only assigned at 1082 in i915_request_add; if i915_request_skip runs before that with a stale postfix, line 1033 if(rq->postfix < head) memset(vaddr+head, 0, ring->size - head) clears wrong region.

## Realistic impact ceiling (on suitable HW)

kernel memory corruption (memset on wrong ring region) or info leak of stale ring contents

## Fix

Initialise rq->head/rq->infix/rq->postfix/rq->tail to 0 alongside the other hand-clears in i915_request_alloc.

See `fix.diff` for the git-apply-able patch.

## How to validate the fix

```sh
scp -F dfbsd-qemu/config fix.diff dfbsd:/root/DF-1527.diff
ssh -F dfbsd-qemu/config dfbsd 'cd /usr/src && patch -p1 --forward < /root/DF-1527.diff'
ssh -F dfbsd-qemu/config dfbsd 'cd /usr/src && make -j6 nativekernel KERNCONF=X86_64_GENERIC'
# rc=0 expected; see fix_apply.log + fix_build.log in this folder.
```