# DF-3628 — Unvalidated VBT `backlight.controller` used as PPS register index (OOB MMIO on BXT)

- **File:** `sys/dev/drm/i915/intel_dp.c:860-883` (`bxt_power_sequencer_idx`) +
  `sys/dev/drm/i915/intel_bios.c:333` (unvalidated assignment)
- **Class:** CWE-129 (improper validation of array index) → out-of-range MMIO
  register selection, not kernel-RAM OOB
- **Severity:** Low (requires malicious/corrupt VBT — BIOS compromise, or root
  via the `i915.vbt_firmware` module parameter; BXT/GEN9_LP eDP only)
- **Status:** `inconclusive` on the audit guest (no Intel GPU; BXT hardware
  required). Source-level certain for the missing validation.

## Data flow

```
VBT binary (BIOS ROM / i915.vbt_firmware=<file>, root-writable 0400 param)
  └─ intel_bios.c:333   dev_priv->vbt.backlight.controller = method->controller;
       (raw u8, i915_drv.h:1131; valid HW values are 0 and 1 — never range-checked)
  └─ intel_dp.c:861-872  bxt_power_sequencer_idx() returns it unchanged
  └─ intel_dp.c:1014-1019 intel_pps_get_registers():
         pps_idx = bxt_power_sequencer_idx(intel_dp);
         regs->pp_ctrl = PP_CONTROL(pps_idx);
  └─ i915_reg.h:4613  _MMIO_PPS(pps_idx, reg) =
         _MMIO(dev_priv->pps_mmio_base - PPS_BASE + reg + pps_idx * 0x100)
```

With a VBT-supplied `controller` of e.g. 255, every PPS register access for
that connector lands at `pps_mmio_base + 0xFF00` — up to ~64 KB outside the
2-entry PPS register block — and `intel_dp_init_panel_power_sequencer_
registers()` then *writes* panel-power sequencing values there
(intel_dp.c:6013-6019). On BXT `pps_mmio_base = PCH_PPS_BASE` (0xC7200,
intel_display.c:14270), so the stray writes land in neighboring display-block
MMIO space. Result: arbitrary-neighbor MMIO writes with semi-controlled values
→ display engine misprogramming, machine hang/brick-style DoS. Not a kernel
memory-safety violation (MMIO window), hence Low.

## Preconditions

1. BXT / Gemini Lake (IS_GEN9_LP) with eDP panel — rare but supported;
2. attacker-controlled VBT: corrupted BIOS option ROM, malicious firmware, or
   a root user loading one via `i915.vbt_firmware` (i915_params.c:76 — root
   can already do worse, which caps severity at Low/hardening).

## Fix

Clamp the index at the consumer (see `fix.diff`):
`backlight_controller = min(backlight_controller, 1);` — matches the two
hardware PPS units and keeps a corrupt VBT from redirecting MMIO.

## Runtime verification

Guest is virtio-only (`vgapci0 chip=0x1111:1234`); i915 never attaches, BXT
eDP unreachable. `inconclusive` per honest-status policy.