# DF-3592 — VERDICT

**Status: reproduced (logic-level, on-guest) / impact: local DoS-class OOB
read + CPU-stall spin; dormant on stock DFly SI behind accel_working=false**

## Why logic-level

Reaching `si_ib_parse` requires (a) an SI GPU — this guest is virtio-only
(no 0x1002 PCI devices, env.txt) — and (b) on DragonFly specifically,
`rdev->accel_working` to be true, which si.c:6906-6912 unconditionally
sets to false (`#ifdef __DragonFly__` "GPU acceleration disabled for now"),
making `radeon_cs_ioctl` return -EBUSY (radeon_cs.c:662). Neither is
satisfiable here, so the parse loop, its bounds arithmetic, and the exact
dword sequence a malicious CS chunk would deliver were transcribed
statement-faithfully into `ib_parse_oob.c`, with the IB placed at the end
of an mmap'd page followed by PROT_NONE — an exact analogue of the
kernel's exact-size sa_bo sub-allocation (radeon_sa.c:205).

## What was demonstrated (guest, 3/3 runs)

1. **Scenario B — OOB read past `length_dw`**: a lone TYPE3 COND_WRITE
   header (count=0) as the final dword of a length_dw=1 IB. In-kernel the
   gfx_check entry reads `ib[pkt->idx+1]` (si.c:4521) — one dword past the
   allocation — and COND_WRITE would read `ib[pkt->idx+6]` (si.c:4595),
   six past. The harness faults at the first handler read (SIGSEGV,
   exit 42), proving the read crosses the allocation boundary at the exact
   index the kernel would touch.
2. **Scenario A — WRITE_DATA count-underflow spin**: count=0 → loop bound
   `(pkt->count - 2)` prints as 4294967294; the register walk from a
   context-space start register (0x28000, "always valid", si.c:4400) is
   still spinning after 5,000,000 harness iterations (capped with a
   report); the kernel walk continues to ~2^30 iterations before the
   register wraps below 0x28000 — seconds of per-ioctl kernel CPU,
   repeatable and parallel across threads (parse holds no mutex,
   radeon_cs.c:549-559).
3. **Fix validation**: `-DFIXED` (fit check mirroring radeon_cs.c:768 +
   unsigned-safe `i + 2 < pkt->count`) rejects the trailing packet with
   -EINVAL before any handler read, suppresses the spin to 0 iterations,
   exit 0.

## Impact ceiling (honest)

- Read-only OOB (CWE-125): worst case 24 bytes past `ib->ptr[length_dw]`.
  In-pool reads hit neighboring IB data (attacker-influenced anyway);
  past-pool-end reads hit whatever follows the GTT BO's kernel mapping —
  silent garbage or a panic on an unmapped boundary. No write primitive;
  the read values only gate register whitelisting (weak oracle, 1 bit per
  ioctl), so confidentiality impact is negligible.
- The spin is a genuine local DoS primitive when the path is live.
- On stock DragonFly (accel_working=false at si.c:6911) both are dormant —
  reachable only if that DFly-local hack is reverted (one line) or on
  non-DFly trees carrying the same statement-identical parser (upstream
  Linux radeon si.c). Rated Medium for the code defect with the gating
  documented; would be Low on a strictly stock-config impact scale.

## Distinctness

Not DF-1130 (that is firmware-header OOB in the new-format loaders). This
is the userspace-reachable CS parser. The evergreen_ib_parse sibling
(evergreen_cs.c:3519, pre-SI VM asics + SI DMA rings via
evergreen_dma_ib_parse) shares the missing fit check — noted here, filed
out of scope for this file.

## Bottom line

Certain by source (the non-VM twin check at radeon_cs.c:768 proves the
authors knew the invariant; the VM path just never got it) and reproduced
logic-level on-guest 3/3: OOB read at the exact predicted dword index +
underflow spin. fix.diff closes all three facets (fit, min-count, loop
bound).

## Fix status (batch validation)
Applied with the 36 sibling fix.diffs of this batch in findings/poc/_batch41/all_fixes.patch; single in-guest `make -j6 nativekernel KERNCONF=X86_64_GENERIC` completed RC=0 with zero errors under -Werror (full log: findings/poc/_batch41/fix_build8.log). Behavior A/B intentionally skipped for this Info-tier item.