# DF-2012 — Verdict

**Severity:** Medium
**Status:** REPRODUCED (source-only confirmation — driver/HW-gated, not runtime-triggered on QEMU guest)
**Impact:** panic
**Confidence:** certain

## Verdict
REPRODUCED. The cited bug is confirmed real in the audited source at `sys/dev/drm/amd/amdgpu/amdgpu_gart.c:362-363,111-119`.

## Mechanism
amdgpu_gart_init computes num_gpu_pages as unsigned int from u64 gart_size; gmc_v9_0_gart_init computes table_size=num_gpu_pages*8 which wraps mod 2^32. amdgpu_gart_table_vram_alloc trusts wrapped table_size to size VRAM BO; amdgpu_gart_bind writes PTEs past the undersized mapping via writeq(ptr+idx*8).

## Fix
Add overflow guard in amdgpu_gart_init (reject gart_size > UINT_MAX*GPU_PAGE_SIZE) and validate table_size >= num_gpu_pages*sizeof(uint64_t) in amdgpu_gart_table_vram_alloc.

The full git-apply-able diff is in `fix.diff`.

## Build validation
fix.diff applies cleanly and compiles with `-Werror` as part of the batch module build
(all 51 fixes applied to /usr/src, kernel+modules built).

## Notes
Source-only confirmation: this finding is in a GPU/display code path that requires
specific hardware not present in the QEMU guest. The bug is confirmed by source tracing
(cited path:line verified against sys/), and the fix compiles clean. No runtime trigger
was attempted as the relevant device/module is HW-gated.