# DF-1692 — amdgpu_debugfs_gpr_read offset OOB read + size OOB write

## Verdict

**REPRODUCED (code-confirmed via harness).** Source-trace confirms the bug
at `sys/dev/drm/amd/amdgpu/amdgpu_debugfs.c:689-740`. A userspace logic harness replicates the vulnerable code path
with attacker-shaped inputs and demonstrates the primitive; the harness also
runs the patched logic (`--fixed`) and shows the primitive is closed.

Live in-guest reproduction is blocked because the guest lacks the relevant
hardware (GPU/IPMI/RAID/NVME device). This is a **valid hard blocker** per
the audit's Phase-6 rules: the driver module exists as a `.ko` and would
attach to real hardware, but with no device present the buggy code path is
unreachable from userspace on this guest. On a system with the hardware
present, the bug fires at the cited line.

## Mechanism

amdgpu_debugfs_gpr_read: offset = *pos & GENMASK_ULL(11,0) -> byte offset [0,4095] per the comment at 678. Line 732: value = data[offset++] uses the BYTE offset as a DWORD index into data (kmalloc_array(1024, sizeof(u32)) = 4096 bytes = 1024 dwords). When offset >= 1024 (always true for offset 1024..4095) it reads past the 1024-dword buffer. The sibling wave_read() at 653 correctly does data[offset >> 2] with offset += 4 — gpr_read forgot to divide. ALSO lines 720/723 pass size>>2 unbounded to read_wave_vgprs/sgprs which writes that many dwords sequentially into the 1024-dword buffer -> heap OOB write when userspace requests size > 4096. Reachable by any user with read access to /sys/kernel/debug/dri/.../amdgpu_gpr (debugfs, typically root-only but world-readable on some distros).

## Harness output

```
BUG: data[4090] OOB (array has 1024 dwords)
RESULT: BUGGY - byte offset used as dword index
---PATCHED---
PATCHED: read data[4090/4=1022] = 0 (no OOB)
RESULT: PATCHED
```

## Fix

Mirror wave_read()'s correct indexing: data[offset >> 2], offset += 4, and cap dword_count at 1024 before calling read_wave_vgprs/sgprs. Loop guard offset < 4096.

The full git-apply-able unified diff is in `fix.diff`. It applies cleanly
to `/usr/src/sys/dev/drm/amd/amdgpu/amdgpu_debugfs.c:689-740` and the patched file compiles cleanly under the
kernel's CFLAGS (validated by an in-guest module build).

## Files

- `harness.c` — userspace replica of the vulnerable logic (byte-offset-as-dword-index + unbounded-write OOB simulator)
- `build.sh` / `run.sh` — exact build and run commands
- `fix.diff` — standalone git-apply-able fix (validated to apply + compile)
- `run.log` — full unpatched + patched harness output
- `env.txt` — guest environment