{
  "finding_id": "DF-3763",
  "status": "inconclusive",
  "reproduced": 0,
  "impact": "panic",
  "confidence": "certain",
  "verdict": "r100_cs_track_cube() dereferences track->textures[idx].cube_info[face].robj via radeon_bo_size() for faces 0..4 without any NULL check. On r1xx/r2xx (separate_cube=1, r100.c:2400) cube-face BOs are only bound by writing PP_CUBIC_OFFSET_Tx_F registers; track_clear() NULLs all five (r100.c:2453). An authenticated DRI client that enables a cubemap texture (PP_TXFORMAT_0 CUBIC_MAP_ENABLE -> tex_coord_type=2, r100.c:1842), binds the primary texture (PP_TXOFFSET_0 + reloc) and unit enable (PP_CNTL), then submits any draw packet that reaches the texture validator (r100_cs_track_texture_check -> r100_cs_track_cube at r100.c:2226) causes radeon_bo_size(NULL) -> kernel NULL-deref read -> panic. Deterministic, unprivileged-with-GPU-access, pre-R300 only. Identical code is still present in upstream Linux torvalds master (fetched 2026-09-16). NOT executable on the audit guest: QEMU/virtio has no ATI ASIC and no radeonkms module exists (checked: kldstat, /boot/kernel, /boot/modules, /dev/dri, pciconf) - verdict inconclusive at runtime, certain at source level.",
  "exploit_chain": "",
  "evidence": "VERDICT.md (full narrative); df3763_cube_null.c (trigger); build.log (clean compile, cc 8.3 -Wall -O2); run.log (device absent); env.txt (guest has no radeon hw/module); fix.diff",
  "kernel_refs": [
    "sys/dev/drm/radeon/r100.c:2134-2163 (r100_cs_track_cube, no NULL check on cube_info[face].robj)",
    "sys/dev/drm/radeon/r100.c:2225-2228 (separate_cube path reaches it)",
    "sys/dev/drm/radeon/r100.c:1842-1843 (CUBIC_MAP_ENABLE sets tex_coord_type=2)",
    "sys/dev/drm/radeon/r100.c:2451-2457 (cube_info[face].robj initialized NULL and never required)",
    "sys/dev/drm/radeon/r100.c:2400 (separate_cube=1 for all pre-R300 asics)",
    "sys/dev/drm/radeon/radeon_kms.c:912 (CS ioctl gate: DRM_AUTH|DRM_RENDER_ALLOW)"
  ],
  "poc_changes": "Re-seeded PoC from scratch: DF-style _IOWR(d, nr, type) ioctl encoding (uapi drm.h:800), self-contained uapi structs, packet builders verified against r100d.h/radeon_reg.h constants, register reachability verified against r100_reg_safe.h bitmap (102 entries).",
  "attempts": 1,
  "guest_uname": "DragonFly dfbsd 6.5-DEVELOPMENT DragonFly 6.5-DEVELOPMENT #0: Thu Jul  2 06:02:54 UTC 2026 root@dfbsd:/usr/obj/usr/src/sys/X86_64_GENERIC x86_64",
  "runtime_sec": 15,
  "guest_dirty": 0,
  "build_cmd": "cc -Wall -O2 -o df3763_cube_null df3763_cube_null.c",
  "run_cmd": "./df3763_cube_null /dev/dri/renderD128",
  "code_hash": "9f88e3f7e2419eaab4eee19cc16b28273a17b3dd0ea0c4363613a67c62a501ca",
  "notes": "Guest is virtio-only (no ATI ASIC, no radeonkms module, no /dev/dri) - runtime execution impossible; module presence documented in env.txt. Source-level proof is line-exact. DF-1209 (vbpntr underflow) is a separate known finding and is NOT re-reported here.",
  "recommended_fix": "Reject CS with -EINVAL when any of the 5 cube-face BOs is unbound in r100_cs_track_cube()",
  "fix_status": "not_testable",
  "fix_baseline_reproduced": 0,
  "fix_patched_reproduced": 0,
  "fix_verdict": "fix.diff authored from line-exact source analysis; kernel-rebuild validation impossible on this guest (no target ASIC to baseline)",
  "fix_evidence": "fix.diff in pack"
}