# DF-1947 — amdgpu_ucode_init_single_fw / patch_jt multi-GiB heap OOB write harness

Proof-of-concept for the integer underflow + missing bounds in
`amdgpu_ucode_init_single_fw` and `amdgpu_ucode_patch_jt` at
`sys/dev/drm/amd/amdgpu/amdgpu_ucode.c:354-418`.

The bug is **HW-gated** (requires an AMD GPU to fire at runtime in the
kernel); this folder contains the **source+harness proof of the primitive**
plus a `git apply`-able fix that builds cleanly into `amdgpu.ko`.

## Files

| File             | Purpose                                                       |
|------------------|---------------------------------------------------------------|
| `oob_write.c`    | Userspace harness replicating the MEC1/MEC2 arithmetic and proving the OOB write via a guard-page fault. Also analytically shows DMCU_ERAM and patch_jt paths. |
| `build.sh`       | `cc -O2 -Wall -Wextra -o oob_write oob_write.c`               |
| `run.sh`         | Runs the harness.                                              |
| `build.log`      | Final build output.                                            |
| `run.log`        | Decisive run output (underflow + SIGSEGV).                     |
| `fix.diff`       | Standalone fix for init_single_fw + patch_jt.                  |
| `fix_build.log`  | Phase 8: `amdgpu.ko` build output after applying fix (rc=0).   |
| `env.txt`        | Guest environment.                                             |
| `dmesg.txt`      | Proof no AMD GPU is present on the guest.                      |
| `VERDICT.md`     | Full narrative + Phase 6 hard-blocker analysis.                |
| `manifest.json`  | Artifact catalog for the static site.                          |

## Reproduce

```sh
./build.sh && ./run.sh
```

Expected output:

```
MEC1/MEC2 path arithmetic (amdgpu_ucode.c:354-355):
  ucode_size_bytes         = 0x00000010
  jt_size * 4              = 0x00000100
  ucode_size (memcpy len)  = 0xffffff10  (4294967056 bytes)
  ...
=== guard-page proof ===
SIGSEGV at BO+4096  -> write crossed BO end (capacity=4096)
PROVEN: the memcpy length computed by amdgpu_ucode_init_single_fw writes
PAST the destination buffer.
```

## Build the fix

```sh
cd /usr/src
patch -p1 < fix.diff
cd sys/dev/drm/amd/amdgpu
make KERNCONF=X86_64_GENERIC    # ~30 s; rc=0; amdgpu.ko rebuilt
```