# DF-3636 VERDICT

**Status: untested (runtime) / certain (source). Severity Low.**

## Root cause

`sys/dev/drm/i915/i915_gem.c:2323` — `kprintf("i915_gem_fault: CHUNKING PASS\n");`
sits unconditionally inside the partial-view branch of the GTT page-fault
handler. This print has no counterpart in the upstream Linux code this
file was ported from (Linux 4.17-era `i915_gem_fault()`); it is
DragonFly-port debug residue.

## Trigger path (unprivileged)

`DRM_IOCTL_I915_GEM_MMAP_GTT` (DRM_RENDER_ALLOW, i915_drv.c:3247) →
`mmap()` the fake offset → touch pages. For any object larger than
`ggtt.mappable_end / 2` (i915_gem.c:4853-4855 PIN_NONBLOCK heuristic;
256 MB–1 GB typical) the first full-object pin fails with -ENOSPC at
:2319, every single fault then takes the partial-view branch and
prints. One printf per 4 KiB page; a 1 GB object ≈ 262k printf's,
serially rendered on the console. On DFly, console printf renders
character-by-character (much worse on serial console) — this is a
straightforward unauthenticated local slowdown/log-flood (console
freeze for other users, /var/log flooding, dmesg ring churn).

## Why not reproduced

Guest is virtio-only: no /dev/dri, no i915 attachment possible
(evidence in ../DF-3634/run.log and env.txt). The print is directly on
the fault path in source; no race or state needed.

## Impact ceiling

Local DoS (log flood / console stall) — Low. No memory-safety impact.

## Fix

fix.diff removes the kprintf. No behavioral change otherwise.

## Fix status (batch validation)
Applied with the 36 sibling fix.diffs of this batch in findings/poc/_batch41/all_fixes.patch; single in-guest `make -j6 nativekernel KERNCONF=X86_64_GENERIC` completed RC=0 with zero errors under -Werror (full log: findings/poc/_batch41/fix_build8.log). Behavior A/B intentionally skipped for this Info-tier item.