# PoC DF-1595: amdgpu_uvd divide-by-zero via small width/height

**Class:** Divide-by-zero (#DE) -> kernel panic
**Cited site:** `sys/dev/drm/amd/amdgpu/amdgpu_uvd.c:524-526,535-562,614-640,681`

## Reproduction status

HW/module gated — **cannot be live-triggered on the audit QEMU guest.**

The audit guest has only virtio + PIIX3 PCI devices (`pciconf -lv` shows no
AMD/Intel GPU, no ath NIC, no AdvanSys SCSI, no mfi/tws/mrsas RAID, etc.),
so the cited code path is not reachable at runtime on this guest.

The bug is **confirmed at the source level** by tracing the cited path:line
in `sys/dev/drm/amd/amdgpu/amdgpu_uvd.c` and confirming the vulnerable code is
present in the master DEV kernel tree. The `fix.diff` in this folder is
validated to apply cleanly and compile under `-Werror` (see `VERDICT.md`).

## Mechanism

amdgpu_uvd_cs_msg_decode: fs_in_mb = (width/16) * ALIGN(height/16,2) from msg[6]/msg[7] user-controlled. H264 (535-562) and H264-Perf (614-640) compute num_dpb_buffer=8100/fs_in_mb etc. width<16 or height<16 -> fs_in_mb=0 -> div by 0 #DE panic. Post-switch width>pitch check at 681 too late.

## Realistic impact ceiling (on suitable HW)

unprivileged DoS (kernel panic) via UVD decode IB with msg[6]=0; affects CIK/VI/Polaris/Vega

## Fix

Before the switch, reject !width || !height || width<16 || height<16 || !fs_in_mb.

See `fix.diff` for the git-apply-able patch.

## How to validate the fix

```sh
scp -F dfbsd-qemu/config fix.diff dfbsd:/root/DF-1595.diff
ssh -F dfbsd-qemu/config dfbsd 'cd /usr/src && patch -p1 --forward < /root/DF-1595.diff'
ssh -F dfbsd-qemu/config dfbsd 'cd /usr/src && make -j6 nativekernel KERNCONF=X86_64_GENERIC'
# rc=0 expected; see fix_apply.log + fix_build.log in this folder.
```