# DF-2015 - Source Verification

## Verdict: REPRODUCED (source-only confirmation)

**Finding**: sys/dev/drm/radeon/vce_v1_0.c:158-209

**Mechanism**: vce_v1_0_load_fw casts firmware blob as struct vce_v1_0_fw_signature with ZERO validation. num/len/datasize from firmware used as loop bound, memcpy length, write offset → heap OOB write/read.

**Hardware dependency**: Requires radeon VCE (Southern Islands: Tahiti/Verde/Pitcairn/Oland/Aruba).

**Fix**: Validate fw blob size; check num≤64, len≤datasize; bound memcpy to VCE_V1_0_DATA_SIZE.

## Verification method
Source-only confirmation. The cited code path was traced line-by-line in the
audited sys/ tree. The bug exists exactly as described. This is a HW-gated
driver finding — the vulnerable code path requires specific hardware (GPU,
controller, PHY, TPM, etc.) not present in the QEMU audit guest. Runtime
reproduction on this guest is not possible without the hardware.

## Fix validation
fix.diff authored and applied to guest source. All 40 fixes in this batch
compile cleanly in a single combined kernel build: `make -j6 nativekernel
KERNCONF=X86_64_GENERIC` → rc=0, zero -Werror violations.

**Kernel**: DragonFly 6.5-DEVELOPMENT #0: Thu Jul  2 06:02:54 UTC 2026