{
  "finding_id": "DF-3744",
  "status": "inconclusive",
  "reproduced": 0,
  "impact": "none",
  "confidence": "certain",
  "verdict": "radeon_atombios_get_lvds_info() walks the mode-patch record table with while (*record != ATOM_RECORD_END_TYPE) (:1706) \u2014 the only exit conditions are the sentinel byte, known record types stepping by fixed sizes or ucFakeEDIDLength, or an unknown type. Nothing bounds the walk to the VBIOS image: usModePatchTableOffset is an unvalidated u16 (:1697-1705) and record strides are attacker-chosen, so the walk crosses the end of the rdev->bios kmallocd image and keeps reading heap. The fake-EDID branch (:1717-1737) kmallocs max(128,len) and memcpys len (<=255) bytes from record+2 \u2014 with the record placed at the image end this copies up to 255 bytes of ADJACENT KERNEL HEAP into bios_hardcoded_edid; if drm_edid_is_valid() passes (checksum 1/256 odds on uncontrolled bytes; guaranteed for the in-image part), those bytes become the connector EDID blob, readable from userspace (DRM_IOCTL_MODE_GETCONNECTOR). Harness on guest: record at image end, len=200 -> 200/200 bytes read beyond image; walk continues 201+ bytes past end until garbage type. Kernel path unreachable on this guest.",
  "exploit_chain": "crafted LVDS_Info usModePatchTableOffset + fake-EDID record at image tail -> 200+ B heap OOB read copied into bios_hardcoded_edid -> (checksum luck) EDID blob exposed to userspace; otherwise walk continues OOB -> crash",
  "evidence": "harness_lvds.c + build.log + run.log; VERDICT.md; kernel refs sys/dev/drm/radeon/radeon_atombios.c:1691-1752",
  "kernel_refs": [
    "sys/dev/drm/radeon/radeon_atombios.c:1691-1752",
    "sys/dev/drm/radeon/radeon_atombios.c:1717-1737",
    "sys/dev/drm/radeon/radeon_bios.c:269-292"
  ],
  "poc_changes": "harness written from scratch (no seed PoC): verbatim kernel arithmetic replica with canary-guarded destination model, built and executed on the DragonFly guest (cc 8.3); fixed nested-comment, stddef/stdint includes and volatile divisors during bring-up",
  "attempts": 3,
  "guest_uname": "DragonFly dfbsd 6.5-DEVELOPMENT DragonFly 6.5-DEVELOPMENT #0: Thu Jul  2 06:02:54 UTC 2026     root@dfbsd:/usr/obj/usr/src/sys/X86_64_GENERIC  x86_64",
  "runtime_sec": 6,
  "guest_dirty": 0,
  "build_cmd": "./build.sh",
  "run_cmd": "./run.sh (after ./build.sh)",
  "code_hash": "6945f6d39a83a5c33eb7dc47f9a037ac9dda07970f923baee8a60f9822aa0e8a",
  "notes": "Guest has NO AMD/radeon GPU (virtio-only); /boot/kernel/radeon.ko exists (code shipped in the default install) but cannot attach, so the kernel code path is unreachable at runtime on this guest. Evidence is source-level certainty (path:line traced) plus a verbatim-arithmetic userland harness compiled and executed on the guest (build.log/run.log).",
  "recommended_fix": "bound the walk to the BIOS image (requires tracking the image length in atom_context)",
  "fix_status": "not_tested",
  "fix_baseline_reproduced": 0,
  "fix_patched_reproduced": 0,
  "fix_verdict": "fix.diff authored after source-level verification; cannot be validated on this guest (no AMD GPU; radeon.ko cannot attach). Compiling the module or booting a patched kernel would not exercise the path without hardware.",
  "fix_evidence": "fix.diff (unified, against read-only sys/ tree; never applied)"
}