{
 "finding_id": "DF-2398",
 "status": "reproduced",
 "reproduced": 1,
 "impact": "corruption",
 "confidence": "certain",
 "verdict": "agp_generic_bind_memory aperture bounds check bypassed by 64-bit wraparound through the VERBATIM production code: control bind at 2x aperture correctly rejected (EINVAL, 0 chipset calls) while the wrap bind offset=0xfffffffffffff000 am_size=0x1000 (pg_start=0xFFFFFFFFFFFFF) PASSED the `offset + mem->am_size > AGP_GET_APERTURE()` check (sum wraps to 0) and invoked the chipset bind_page method at offset 0xfffffffffffff000 - far outside the 64MB aperture. The dead `offset < 0` test (vm_offset_t unsigned) confirmed. Fixed kernel rejects the wrap with EINVAL, 0 chipset calls.",
 "exploit_chain": "AGPIOC_BIND pg_start from userspace wraps the check and reaches the chipset driver with an out-of-aperture GATT index; on the four in-tree chipsets their own bind_page checks currently stop it, but any chipset driver relying on the generic check gets out-of-bounds GATT writes",
 "evidence": "run.log (control error=22 calls=0; WRAP error=0 bind_calls=1 range [0xfffffffffffff000..0xfffffffffffff000]); fixed.log (WRAP error=22 calls=0)",
 "kernel_refs": [
  "sys/dev/agp/agp.c:520",
  "sys/dev/agp/agp.c:522",
  "sys/dev/agp/agp.c:523"
 ],
 "poc_changes": "agp_shim.c verbatim-interposition harness (real agp.c compiled in, agp_if methods + VM accessors interposed) written for this batch",
 "attempts": 2,
 "guest_uname": "DragonFly dfbsd 6.5-DEVELOPMENT DragonFly 6.5-DEVELOPMENT #7: Sat Oct 24 00:08:04 UTC 2026     root@dfbsd:/usr/obj/usr/src/sys/ACHARNESS  x86_64",
 "runtime_sec": 400,
 "guest_dirty": 0,
 "runner": "df-bsd-reviewer",
 "build_cmd": "make -j5 nativekernel KERNCONF=ACHARNESS (see build.sh; stock-kernel findings need no build)",
 "run_cmd": "see run.sh",
 "code_hash": "cb21865e4336f2800be8cae82626093876efb27f589b4927a8ab27d7e83ed8bf",
 "notes": "",
 "recommended_fix": "see fix.diff",
 "fix_status": "compile_validated"
}