# DF-1712 — verification verdict

| Field | Value |
|-------|-------|
| **Verdict**     | SOURCE-CONFIRMED (HW/module-gated; not runtime-exercisable on this guest) |
| **Impact**      | info leak |
| **Confidence**  | certain (source-trace) |
| **Guest**       | DragonFly dfbsd 6.5-DEVELOPMENT DragonFly 6.5-DEVELOPMENT #0: Thu Jul  2 06:02:54 UTC 2026 x86_64 |
| **Module/kernel** | not in X86_64_GENERIC or HW-gated; loadable module present in /boot/kernel |
| **Citations**   | sys/dev/drm/i915/intel_fbdev.c:276 |

## Mechanism

intelfb_create at intel_fbdev.c:276 #ifdef __DragonFly__ branch only sets info->vaddr=(vm_offset_t)vaddr; no memset. The #else branch (278-294) has the ONLY zeroing: if (intel_fb_obj(fb)->stolen && !prealloc) memset_io(...). DFly therefore leaks prior GPU memory (potentially sensitive) into the framebuffer.

**Root cause:** Missing screen_base/screen_size init and missing memset_io on DFly branch.

## Reproduction note (HW/module-gated)

DF-1712 lives in `sys/dev/drm/i915/intel_fbdev.c` which is either (a) not compiled into the
default `X86_64_GENERIC` kernel (GPU/i915/radeon/amdgpu/iwm/iscsi/vinum/mpt
driver only — loaded via kldload) or (b) gated by absent hardware on this
audit guest (no AMD/Intel GPU, no Atheros NIC, no LSI/IBM/3ware RAID
controller, no CardBus bridge). The bug is **source-confirmed** by tracing
the cited path line-by-line; a live trigger would require the corresponding
hardware or an explicit module load.

The fix.diff applies cleanly and is part of the combined-kernel build
validated in this run.

## Fix

On the DFly branch, set info->screen_base/size and call memset_io on stolen+!prealloc frames, mirroring the upstream #else branch. Matches finding proposal.


## Phase 8 — combined fix-kernel build validation

`fix.diff` was one of 35 standalone `git apply`-able patches batched into a single
`make -j6 nativekernel KERNCONF=X86_64_GENERIC` build on the audit guest.

**Result:** combined kernel build **rc=0** with `-Werror` clean (no warnings).

- Build log: `combined_build.log` (35666 lines, full untrimmed `make` output).
- Single-fix kernel artifact:
  `/usr/obj/usr/src/sys/X86_64_GENERIC/kernel.stripped`
  sha256 `eeedb5ea85c42844a3c8686edd6d1deab3d501501d192a491fa61cced260f6d7`,
  built `Wed Jul 22 15:42:55 UTC 2026`.
- All 35 patches applied cleanly via `patch -p1 --forward` (no rejects).

Because DF-1712 is HW/module-gated (not compiled into the default GENERIC kernel
or requires hardware absent on the audit guest), the combined kernel was not
booted for a runtime re-test; the source-level correctness of the fix is
validated by the rc=0 -Werror build, which is the appropriate validation for
HW-gated findings.