# DF-1946 — amdgpu_ucode_validate bypass harness

Proof-of-concept for the missing-size / missing-bounds checks in
`amdgpu_ucode_validate` at `sys/dev/drm/amd/amdgpu/amdgpu_ucode.c:251-260`.

The bug is **HW-gated** (requires an AMD GPU to fire at runtime in the
kernel); this folder contains the **source+harness proof** plus a
`git apply`-able fix that builds cleanly into `amdgpu.ko`.

## Files

| File                | Purpose                                                |
|---------------------|--------------------------------------------------------|
| `validate_bypass.c` | Userspace harness replicating `amdgpu_ucode_validate` (vanilla + fixed). |
| `build.sh`          | `cc -O2 -Wall -Wextra -o validate_bypass validate_bypass.c` |
| `run.sh`            | Runs the harness.                                       |
| `build.log`         | Final build output.                                     |
| `run.log`           | Decisive run output (5 cases).                          |
| `fix.diff`          | Standalone fix for the validate gateway.               |
| `fix_build.log`     | Phase 8: `amdgpu.ko` build output after applying fix (rc=0). |
| `env.txt`           | Guest environment.                                     |
| `dmesg.txt`         | Proof no AMD GPU is present on the guest.              |
| `VERDICT.md`        | Full narrative.                                        |
| `manifest.json`     | Artifact catalog for the static site.                  |

## Reproduce

```sh
./build.sh && ./run.sh
```

Expected: for each of the 4 malicious cases, vanilla `amdgpu_ucode_validate`
prints `PASS (rc=0) <- bug: caller will deref OOB` and the fixed version
prints `REJECT (rc=-22)`. The legitimate baseline passes both.

## Build the fix

```sh
cd /usr/src
patch -p1 < fix.diff
cd sys/dev/drm/amd/amdgpu
make KERNCONF=X86_64_GENERIC    # ~30 s; rc=0; amdgpu.ko rebuilt
```