# DF-1968 Verification

## Verdict
**SOURCE-CONFIRMED, INCONCLUSIVE-RUNTIME (HW/module gated).**

The cited defect exists in the audited source at `sys/dev/drm/radeon/radeon_fb.c:142-158`.
radeon is not in GENERIC and requires real radeon GPU hardware not present
in the audit QEMU/KVM guest.

## Mechanism (source-only confirmation)
radeonfb_create_pinned_object computes size = mode_cmd->pitches[0] * height
at L154 in 32-bit arithmetic (u32 × int → u32 → int), no overflow check.
Pitch from radeon_align_pitch can be up to 65536 (width>=16384 cpp=4); height
amplified by ALIGN(.,8) and drm_fbdev_overalloc (up to 200). Product wraps
to small positive → undersized GEM BO while fb->pitches[0] stores full pitch
→ OOB in later stride×y consumers (syscons sckmsrndr).

## Recommended fix
Make size/aligned_size u64, compute size=(u64)pitches[0]*height, reject if
> UINT_MAX before allocating.

The full `git apply`-able diff lives in `fix.diff` in this folder.