{
  "finding_id": "DF-3572",
  "status": "not_reproduced",
  "reproduced": 0,
  "impact": "none",
  "confidence": "likely",
  "verdict": "Not runtime-reproducible on the audit guest: it has a virtio GPU (chip 0x11111234), /dev/dri does not exist, and i915 is not in the stock X86_64_GENERIC kernel (i915.ko is shipped as a module that only loads on real Intel iGPUs \u2014 where it is the default graphics driver). Source-level verification is conclusive: intel_pm.c:4252/4259 accumulate per-plane relative data rates (each up to ~2.4e9, produced by mul_round_up_u32_fixed16 at i915_drv.h:199 which truncates its u64 intermediate to u32) in a u32 total_data_rate; three legal overlapping planes (primary 8192x8192 + two 4096x8192 sprites, all ARGB8888, all ~3x-per-axis downscaled onto a 2731x2731@60 pipe) sum to 4,829,822,976 which wraps to 534,855,680. The wrapped denominator inflates every planes proportional share in skl_allocate_pipe_ddb (intel_pm.c:4441/4456), emitting PLANE_BUF_CFG DDB entries up to 7789 blocks inside an 892-block per-pipe DDB; nothing bounds entries against ddb_size (skl_ddb_allocation_overlaps at intel_display.c:12696 only orders cross-PIPE updates) and the watermark ddb_allocation check is fed the same inflated share so it passes. Programmed out-of-range DDB = overlapping display buffer allocations = display FIFO underrun / pipe wedge \u2014 a local DoS by any DRM master on SKL+. Impact ceiling is display DoS only; corrupted values flow to display registers, not kernel memory, so no privesc route exists. Linux v5.2 computes these rates in u64 (upstream_v5.2_divergence.diff); this DragonFly tree keeps the pre-v5.2 u32 arithmetic.",
  "exploit_chain": "",
  "evidence": "run.log (exact-integer reproduction: wrap 4829822976 -> 534855680, DDB entries [0,3891] [3891,5840] [5840,7789] vs ddb_size 892); upstream_v5.2_divergence.diff (Linux v5.2 u64 vs this tree u32); env.txt (guest virtio-gpu, no /dev/dri, i915 not in GENERIC, not loaded); fix.diff (git-apply-able u64 backport, verified to apply cleanly against sys/dev/drm/i915/intel_pm.c)",
  "kernel_refs": [
    "sys/dev/drm/i915/intel_pm.c:4216",
    "sys/dev/drm/i915/intel_pm.c:4220",
    "sys/dev/drm/i915/intel_pm.c:4252",
    "sys/dev/drm/i915/intel_pm.c:4259",
    "sys/dev/drm/i915/intel_pm.c:4400",
    "sys/dev/drm/i915/intel_pm.c:4441",
    "sys/dev/drm/i915/intel_pm.c:4456",
    "sys/dev/drm/i915/intel_pm.c:4773",
    "sys/dev/drm/i915/intel_pm.c:5012",
    "sys/dev/drm/i915/intel_pm.c:5115",
    "sys/dev/drm/i915/i915_drv.h:199",
    "sys/dev/drm/i915/intel_display.c:10926",
    "sys/dev/drm/i915/intel_display.c:12696",
    "sys/dev/drm/i915/intel_display.c:13367"
  ],
  "poc_changes": "no seed PoC existed (new pass-2 finding); wrote wm_datarate_wrap.py implementing the kernels fixed16 helpers verbatim from i915_drv.h and the exact reachable plane/mode configuration (per-axis 3x scaler cap, sprite 4096 src-width cap, modeset-only pixel-rate gate)",
  "attempts": 2,
  "guest_uname": "DragonFly dfbsd 6.5-DEVELOPMENT DragonFly 6.5-DEVELOPMENT #0: Thu Jul  2 06:02:54 UTC 2026  root@dfbsd:/usr/obj/usr/src/sys/X86_64_GENERIC  x86_64",
  "runtime_sec": 18,
  "guest_dirty": 0,
  "build_cmd": "none (pure-python arithmetic model of the kernel code path)",
  "run_cmd": "python3 wm_datarate_wrap.py",
  "code_hash": "d3c604e1132773e0e76c50cee592be31575ad68988537aa0d4e51cb577a3d721",
  "notes": "Runtime impact field is none strictly because the guest has no i915 hardware; the demonstrated impact ceiling is local display DoS (FIFO underrun/pipe wedge) by a DRM master on Intel SKL+. Same impact family as pass-1 DF-1118 (skl_wm_method1/2) but distinct functions, distinct sink (DDB allocation), distinct fix (v5.2 u64 rework). Attempt 1 config was invalid (violated the per-axis 3x scaler cap) and was corrected; final config respects skl_max_scale, sprite width limits, and the modeset-time pixel-rate gate. fix.diff verified git-apply-able against the pristine file (git apply --check) and identical to the intended patched result.",
  "recommended_fix": "Backport the Linux v5.2 u64 arithmetic for skl_plane_relative_data_rate/skl_get_total_relative_data_rate (see fix.diff)",
  "fix_status": "not_testable",
  "fix_baseline_reproduced": 0,
  "fix_patched_reproduced": 0,
  "fix_verdict": "fix.diff is a faithful backport of the upstream v5.2 u64 computation and applies cleanly to sys/dev/drm/i915/intel_pm.c (verified with git apply --check in a scratch copy; sys/ was not modified). Behavioral fix validation requires Intel SKL+ display hardware which the audit guest lacks (virtio GPU, i915 never loads), so baseline-vs-patched runtime comparison is not testable here; the arithmetic model in wm_datarate_wrap.py shows the patched types make the wrap impossible (u64 sum 4,829,822,976 no longer truncates).",
  "fix_evidence": "fix.diff (git-apply-able, verified); VERDICT.md Fix section; run.log wrap demonstration"
}