# DF-3636 — Leftover debug `kprintf("i915_gem_fault: CHUNKING PASS\n")` on the unprivileged partial-view fault hot path

## What

`sys/dev/drm/i915/i915_gem.c:2323`:

```c
2315	vma = i915_gem_object_ggtt_pin(obj, NULL, 0, 0,
2316				       PIN_MAPPABLE |
2317				       PIN_NONBLOCK |
2318				       PIN_NONFAULT);
2319	if (IS_ERR(vma)) {
2320		/* Use a partial view if it is bigger than available space */
2321		struct i915_ggtt_view view =
2322			compute_partial_view(obj, page_offset, MIN_CHUNK_PAGES);
2323		kprintf("i915_gem_fault: CHUNKING PASS\n");
```

This is a port-time debug print (not present in the Linux original —
upstream 4.17 has no printk on this path) left in the production fault
path for partial GTT views. It executes **once per page fault** whenever
an object larger than half the mappable aperture (the `PIN_NONBLOCK`
half-aperture heuristic, i915_gem.c:4853-4855) is GTT-mapped and
touched.

## Threat

Any unprivileged user with DRM render access can, without any
authentication:

1. `DRM_IOCTL_I915_GEM_CREATE` an object > mappable_end/2 (256 MB–1 GB
   depending on gen);
2. `DRM_IOCTL_I915_GEM_MMAP_GTT` + `mmap()` it;
3. touch every page in a loop.

Each 4 KiB fault prints a line to the console (and kern.msgsyslog). A
1 GB object on a 2 GB-mappable part ≈ 262 144 kernel printf's, serially
rendered — the DFly console (especially serial console) is notoriously
slow at rendered printf, so this is both a system-wide slowdown and
unbounded log/disk flooding (`/var/log/messages`, dmesg ring churn).
CWE-117-adjacent (unbounded diagnostic output from untrusted input) →
local DoS / log-flood. Low severity (no memory-safety impact).

## Verification

Source-certain (the kprintf is directly on the fault path); not runtime
testable on this guest (no i915 device — see DF-3634/run.log). Status:
untested.

## Fix

Delete the kprintf (fix.diff). The other fault-path kprintfs
("i915: caught bug(...)" at :2301, :2307, :2345, :2353, :2359, :2478,
:2500) fire only on genuine error conditions and are ratelimited by
their nature; CHUNKING PASS is the only unconditional per-fault print.