# PoC DF-1537: radeon atom.c WS index NULL deref + heap OOB

**Class:** NULL deref + heap OOB write
**Cited site:** `sys/dev/drm/radeon/atom.c:1175,1187-1190,234,267,508,537`

## Reproduction status

HW/module gated — **cannot be live-triggered on the audit QEMU guest.**

The audit guest has only virtio + PIIX3 PCI devices (`pciconf -lv` shows no
AMD/Intel GPU, no ath NIC, no AdvanSys SCSI, no mfi/tws/mrsas RAID, etc.),
so the cited code path is not reachable at runtime on this guest.

The bug is **confirmed at the source level** by tracing the cited path:line
in `sys/dev/drm/radeon/atom.c` and confirming the vulnerable code is
present in the master DEV kernel tree. The `fix.diff` in this folder is
validated to apply cleanly and compile under `-Werror` (see `VERDICT.md`).

## Mechanism

ws=CU8(base+ATOM_CT_WS_PTR) u8 0..255. 1187-1190: if(ws) kzalloc(4*ws) else ectx.ws=NULL. WS handlers index ctx->ws[idx] where idx=U8(0..255) at 234/267/508/537 with NO idx<ws check. Default case 267 val=ctx->ws[idx], 537 ctx->ws[idx]=val. Case 1 ws=0: NULL[idx] -> panic. Case 2 ws>0 idx>=ws: heap OOB.

## Realistic impact ceiling (on suitable HW)

kernel panic (NULL deref) or up to ~1020-byte heap OOB read+write via crafted VBIOS

## Fix

Add ws_size field to atom_exec_context; validate idx<ws_size in both WS handlers; reset ws_size to 0 on OOM.

See `fix.diff` for the git-apply-able patch.

## How to validate the fix

```sh
scp -F dfbsd-qemu/config fix.diff dfbsd:/root/DF-1537.diff
ssh -F dfbsd-qemu/config dfbsd 'cd /usr/src && patch -p1 --forward < /root/DF-1537.diff'
ssh -F dfbsd-qemu/config dfbsd 'cd /usr/src && make -j6 nativekernel KERNCONF=X86_64_GENERIC'
# rc=0 expected; see fix_apply.log + fix_build.log in this folder.
```