# DF-3764 - VERDICT

**status: inconclusive (runtime)** | reproduced: 0 | impact (expected): leak | confidence: certain (source)

## What was verified
r100_packet3_check() unconditionally reads payload dwords at fixed offsets (idx+1 for DRAW_VBUF/DRAW_INDX/DRAW_IMMD, up to idx+3 for the 0x23 packet) while radeon_cs_packet_parse() only validates that the packet header+count fit: pkt->idx + count + 1 < length_dw (radeon_cs.c:768). A truncated packet (count=0) placed as the last 2 dwords of the IB therefore makes the handler read ib[length_dw] - one dword past the IB chunk. radeon_get_ib_value() (radeon.h:1098) has no bounds check. On AGP systems the IB chunk is a kvmalloc'd array of exactly length_dw dwords (radeon_cs.c:337-346) -> 4-byte kernel heap OOB read; on PCI/PCIe it reads past the radeon_sa_bo sub-allocation (exactly length_dw*4, radeon_ib.c:60) into the shared IB pool (stale/other-process GPU commands). The OOB dword becomes track->vap_vf_cntl and, on the IMMD mismatch path, is printed to the kernel log as 'VAP_VF_CNTL.NUM_VERTICES %u' (r100.c:2364-2367) - dmesg is world-readable, giving a repeated 16-bit heap-disclosure oracle. Same class as DF-1492 (r300) and DF-3592 (si). NOT runtime-verifiable on this guest (no ATI ASIC / radeonkms): inconclusive at runtime, certain at source level.

## Kernel references
- sys/dev/drm/radeon/r100.c:2013-2017 (PACKET3_3D_DRAW_VBUF reads idx+1 unvalidated)
- sys/dev/drm/radeon/r100.c:2020-2024 (PACKET3_3D_DRAW_INDX reads idx+1)
- sys/dev/drm/radeon/r100.c:1974-1984 (PACKET3_3D_DRAW_IMMD reads idx+1)
- sys/dev/drm/radeon/r100.c:1951-1972 (0x23 3D_RNDR_GEN_INDX_PRIM reads idx+1..idx+3)
- sys/dev/drm/radeon/radeon_cs.c:768 (fit check guarantees only pkt->idx+count+1 < length_dw)
- sys/dev/drm/radeon/radeon.h:1098-1105 (radeon_get_ib_value: no bounds check)
- sys/dev/drm/radeon/r100.c:2362-2368 (leak sink: DRM_ERROR prints NUM_VERTICES derived from OOB dword)

## Why not reproduced on the guest
Guest = DragonFly 6.5-DEVELOPMENT x86_64 under QEMU (virtio-only):
- kldstat: only kernel + ehci.ko + xhci.ko (drm.ko exists in /boot/kernel but is not loaded and there is no radeonkms.ko anywhere)
- /dev/dri does not exist
- pciconf shows no vendor-1002 (ATI) device
=> The radeon CS ioctl path cannot execute. The finding is proven by
line-exact source analysis (integer identities / NULL flow), and the PoC
is proven to build (build.log, cc 8.3 -Wall -O2, zero warnings).

## Upstream comparison
Checked against Linux torvalds master r100.c (fetched 2026-09-16):
identical unvalidated fixed-offset reads present upstream (equivalent; class matches DF-1492/DF-3592).

## Fix
fix.diff in this directory (not applied to the read-only sys/ tree; kernel
rebuild validation not possible - no target ASIC).

## Fix status (batch validation)
Applied with the 36 sibling fix.diffs of this batch in findings/poc/_batch41/all_fixes.patch; single in-guest `make -j6 nativekernel KERNCONF=X86_64_GENERIC` completed RC=0 with zero errors under -Werror (full log: findings/poc/_batch41/fix_build8.log). Behavior A/B intentionally skipped for this Info-tier item.