# DF-3598 — VERDICT

**status: inconclusive (kernel run) / source certain**
**reproduced: 0**

## Proof

`awk`-verified call sites in `gfx_v8_0_init_microcode`
(sys/dev/drm/amdgpu/gfx_v8_0.c):

```
1019  GUARDED    amdgpu_ucode_validate(pfp_fw)   -> :1020 if (err) goto out
1039  GUARDED    amdgpu_ucode_validate(me_fw)    -> :1040
1060  GUARDED    amdgpu_ucode_validate(ce_fw)    -> :1061
1082  UNGUARDED  amdgpu_ucode_validate(rlc_fw)   -> next executable statement is
                                                    rlc_hdr = ... rlc_fw->data (:1083)
1140  GUARDED    amdgpu_ucode_validate(mec_fw)   -> :1141
1161  GUARDED    amdgpu_ucode_validate(mec2_fw)  -> :1162
```

`err` is not consumed between :1082 and the next assignment
(`err = request_firmware(... mec ...)` :1129), so the RLC validation result is
silently discarded and a wrong-sized RLC firmware proceeds to header parsing
(:1083-1104) and the register-list kmalloc/copy (:1106-1125).

Blast radius if the RLC file is truncated below
`sizeof(struct rlc_firmware_header_v2_0)` = 72 bytes (20 header dwords + 18
v2.0 dwords, amdgpu_ucode.h:79-99): the field reads at :1083-1104 are
themselves OOB reads of the firmware buffer; the garbage sizes/offsets then
feed DF-1133's copy loops (heap OOB) and `adev->firmware.fw_size`
(:1197-1209). With a merely *mismatched* (but structurally large) file, the
skipped `datasize == size_bytes` gate lets inconsistent lengths through.

## Why not a kernel run

Audit guest is virtio-only: no AMD PCI device, no drm/amdgpu module
(`kldstat -v | grep -c drm` = 0), `/boot/modules` absent. Loading a crafted
`amdgpufw_*_rlc` requires the driver to bind real VI hardware. Hence
`inconclusive` at runtime; the source defect is unambiguous.

## Fix validation

`fix.diff` adds the two-line symmetric guard after :1082. Single-fix kernel
build not possible on this guest (module absent) — `fix_status:
not_testable`; diff line-matched against the current tree.

## kernel_refs

- sys/dev/drm/amd/amdgpu/gfx_v8_0.c:1082 (unchecked validate)
- sys/dev/drm/amd/amdgpu/gfx_v8_0.c:1083-1125 (unguarded consumers)
- sys/dev/drm/amd/amdgpu/gfx_v8_0.c:1019-1021,1039-1041,1060-1062,1140-1142,1160-1163 (guarded contrast)
- sys/dev/drm/amd/amdgpu/amdgpu_ucode.h:79-99 (header size 0x48)

## Fix status (batch validation)
Applied with the 36 sibling fix.diffs of this batch in findings/poc/_batch41/all_fixes.patch; single in-guest `make -j6 nativekernel KERNCONF=X86_64_GENERIC` completed RC=0 with zero errors under -Werror (full log: findings/poc/_batch41/fix_build8.log). Behavior A/B intentionally skipped for this Info-tier item.