# DF-1985 Verification

## Verdict
**SOURCE-CONFIRMED, INCONCLUSIVE-RUNTIME (HW/module gated).**

The cited defect exists in the audited source at `sys/dev/drm/amd/amdgpu/amdgpu_fb.c:263`.
amdgpu is not in GENERIC and requires real AMD GPU hardware.

## Mechanism (source-only confirmation)
amdgpu_fb.c:263 info->stride = fb->pitches[0] narrows u32 to uint16_t. For
width=16384 cpp=4 amdgpu_align_pitch returns 65536 → stride wraps to 0.
syscons.c:4091 sz=roundup(height*stride, PAGE_SIZE); stride=0 → sz=0;
L4092 "a_offset > sz - PAGE_SIZE" underflows size_t to SIZE_MAX (always false)
→ bounds check defeated; L4097 returns atop(vtophys(vaddr + arbitrary
a_offset)) for mmap → arbitrary physical page exposure.

## Recommended fix
Add an overflow check: if fb->pitches[0] > 0xffff, return -EINVAL before the
truncating assignment.

The full `git apply`-able diff lives in `fix.diff` in this folder.