# PoC DF-1593: rv515.c debugfs ga_info triggers GPU reset on read

**Class:** DoS / availability (unprivileged GPU reset)
**Cited site:** `sys/dev/drm/radeon/rv515.c:250-263,286`

## Reproduction status

HW/module gated — **cannot be live-triggered on the audit QEMU guest.**

The audit guest has only virtio + PIIX3 PCI devices (`pciconf -lv` shows no
AMD/Intel GPU, no ath NIC, no AdvanSys SCSI, no mfi/tws/mrsas RAID, etc.),
so the cited code path is not reachable at runtime on this guest.

The bug is **confirmed at the source level** by tracing the cited path:line
in `sys/dev/drm/radeon/rv515.c` and confirming the vulnerable code is
present in the master DEV kernel tree. The `fix.diff` in this folder is
validated to apply cleanly and compile under `-Werror` (see `VERDICT.md`).

## Mechanism

rv515_debugfs_ga_info show() callback calls radeon_asic_reset(rdev) unconditionally between two register reads. Registered via radeon_debugfs_add_files at 286; DRM info-list entries default S_IFREG|S_IRUGO world-readable. Any local user who cat /sys/kernel/debug/dri/N/rv515_ga_info triggers full GPU reset: aborts CP ring, drops in-flight DMA, blanks displays, crashes X/Wayland. Repeatable indefinitely. Sibling ASICs do NOT call asic_reset in their ga_info handlers.

## Realistic impact ceiling (on suitable HW)

unprivileged DoS of the GPU subsystem (and any GPU-accelerated process)

## Fix

Drop the radeon_asic_reset(rdev) call from rv515_debugfs_ga_info; sibling handlers do not reset.

See `fix.diff` for the git-apply-able patch.

## How to validate the fix

```sh
scp -F dfbsd-qemu/config fix.diff dfbsd:/root/DF-1593.diff
ssh -F dfbsd-qemu/config dfbsd 'cd /usr/src && patch -p1 --forward < /root/DF-1593.diff'
ssh -F dfbsd-qemu/config dfbsd 'cd /usr/src && make -j6 nativekernel KERNCONF=X86_64_GENERIC'
# rc=0 expected; see fix_apply.log + fix_build.log in this folder.
```