{
  "finding_id": "DF-3765",
  "verdict": "inconclusive",
  "reproduced": 0,
  "impact": "leak",
  "confidence": "certain",
  "reproduce": {
    "build": "cc -Wall -O2 -o df3765_max_indx df3765_max_indx.c",
    "run": "./df3765_max_indx /dev/dri/renderD128",
    "expected": "panic (DF-3763) / dmesg NUM_VERTICES leak (DF-3764) / ioctl returns 0 = bypass (DF-3765/3766)"
  },
  "kernel_refs": [
    "sys/dev/drm/radeon/r100.c:2323-2341 (PW=1 check: size = esize * max_indx * 4 in 32-bit unsigned)",
    "sys/dev/drm/radeon/r100.c:1966 (max_indx = radeon_get_ib_value(p, idx+1): full attacker u32)",
    "sys/dev/drm/radeon/r100.c:2424 (default max_indx 0x00FFFFFF)"
  ],
  "artifacts": [
    "df3765_max_indx.c",
    "build.sh",
    "run.sh",
    "build.log",
    "run.log",
    "env.txt",
    "fix.diff",
    "VERDICT.md",
    "manifest.json",
    "verdict.json"
  ]
}