{
  "finding_id": "DF-3739",
  "status": "inconclusive",
  "reproduced": 0,
  "impact": "none",
  "confidence": "certain",
  "verdict": "Source-certain heap-corruption write in the radeon ATOM I2C init path. atom_parse_data_header() (atom.c:1366-1385) returns the GPIO_I2C_Info tables self-declared u16 size with NO validation; radeon_atombios_i2c_init() derives num_indices=(size-4)/28 (up to 2340 with size=0xFFFF) and stores radeon_i2c_create() heap pointers into rdev->i2c_bus[i] (radeon.h:2440) whose capacity is RADEON_MAX_I2C_BUS=16 (radeon_mode.h:96). i2c.valid is BIOS-controlled (usClkMaskRegisterIndex!=0, :113-116), so every OOB store is attacker-gated. Entries 16..num_indices-1 overwrite the following radeon_device fields (debugfs[32], debugfs_count, vm_manager, gpu_clock_mutex, atif/atcs, ... radeon.h:2441+). Harness on guest: size=4092 -> 146 entries -> 130 OOB pointer writes (1040 B); worst case 0xFFFF -> 2324 OOB writes (18.5 KB). Not executable in-kernel on this guest (no AMD GPU); module present in /boot/kernel/radeon.ko.",
  "exploit_chain": "crafted VBIOS GPIO_I2C_Info table with size>=4+17*28=480 -> i2c valid entries -> heap pointer corruption inside struct radeon_device at driver attach (boot or kldload radeon) -> crash/DoS, potential further exploitation via corrupted adjacent structures (locks, vm_manager)",
  "evidence": "harness_i2c.c + build.log + run.log; VERDICT.md; kernel refs sys/dev/drm/radeon/radeon_atombios.c:172-187",
  "kernel_refs": [
    "sys/dev/drm/radeon/radeon_atombios.c:172-187",
    "sys/dev/drm/radeon/radeon_atombios.c:113-116",
    "sys/dev/drm/radeon/atom.c:1366-1385",
    "sys/dev/drm/radeon/radeon.h:2440-2442",
    "sys/dev/drm/radeon/radeon_mode.h:96"
  ],
  "poc_changes": "harness written from scratch (no seed PoC): verbatim kernel arithmetic replica with canary-guarded destination model, built and executed on the DragonFly guest (cc 8.3); fixed nested-comment, stddef/stdint includes and volatile divisors during bring-up",
  "attempts": 3,
  "guest_uname": "DragonFly dfbsd 6.5-DEVELOPMENT DragonFly 6.5-DEVELOPMENT #0: Thu Jul  2 06:02:54 UTC 2026     root@dfbsd:/usr/obj/usr/src/sys/X86_64_GENERIC  x86_64",
  "runtime_sec": 6,
  "guest_dirty": 0,
  "build_cmd": "./build.sh",
  "run_cmd": "./run.sh (after ./build.sh) on the DragonFly guest",
  "code_hash": "fa1bfc164ff500d08a028ed47eae30dc91ccf4ce9bda4c78c681ad67d593af91",
  "notes": "Guest has NO AMD/radeon GPU (virtio-only); /boot/kernel/radeon.ko exists (code shipped in the default install) but cannot attach, so the kernel code path is unreachable at runtime on this guest. Evidence is source-level certainty (path:line traced) plus a verbatim-arithmetic userland harness compiled and executed on the guest (build.log/run.log).",
  "recommended_fix": "cap the loop at RADEON_MAX_I2C_BUS",
  "fix_status": "not_tested",
  "fix_baseline_reproduced": 0,
  "fix_patched_reproduced": 0,
  "fix_verdict": "fix.diff authored after source-level verification; cannot be validated on this guest (no AMD GPU; radeon.ko cannot attach). Compiling the module or booting a patched kernel would not exercise the path without hardware.",
  "fix_evidence": "fix.diff (unified, against read-only sys/ tree; never applied)"
}