{
  "finding_id": "DF-3765",
  "status": "inconclusive",
  "reproduced": 0,
  "impact": "leak",
  "confidence": "certain",
  "verdict": "In r100_cs_track_check() the PW=1 vertex-array bound is computed as track->arrays[i].esize * track->max_indx * 4 with all factors unsigned int; the product wraps mod 2^32. max_indx is set verbatim from the IB by the 3D_RNDR_GEN_INDX_PRIM (0x23) handler (r100.c:1966) with no mask, so esize=2 / max_indx=0x80000000 yields size==0 and the validator accepts a draw that instructs the GPU to fetch 0x80000000 indices from a 64KB BO -> GPU DMA reads far outside the object (cross-process GPU-memory disclosure via rendering readback, and/or GPU hang/lockup). Upstream Linux has * 4UL which still wraps in the u32 esize*max_indx product, so this is a carried upstream defect (variant). PoC builds and exits 1 on this guest: no ATI ASIC / radeonkms module -> inconclusive at runtime, certain at source level (integer identities).",
  "exploit_chain": "",
  "evidence": "VERDICT.md (full narrative); df3765_max_indx.c (trigger); build.log (clean compile, cc 8.3 -Wall -O2); run.log (device absent); env.txt (guest has no radeon hw/module); fix.diff",
  "kernel_refs": [
    "sys/dev/drm/radeon/r100.c:2323-2341 (PW=1 check: size = esize * max_indx * 4 in 32-bit unsigned)",
    "sys/dev/drm/radeon/r100.c:1966 (max_indx = radeon_get_ib_value(p, idx+1): full attacker u32)",
    "sys/dev/drm/radeon/r100.c:2424 (default max_indx 0x00FFFFFF)"
  ],
  "poc_changes": "Re-seeded PoC from scratch: DF-style _IOWR(d, nr, type) ioctl encoding (uapi drm.h:800), self-contained uapi structs, packet builders verified against r100d.h/radeon_reg.h constants, register reachability verified against r100_reg_safe.h bitmap (102 entries).",
  "attempts": 1,
  "guest_uname": "DragonFly dfbsd 6.5-DEVELOPMENT DragonFly 6.5-DEVELOPMENT #0: Thu Jul  2 06:02:54 UTC 2026 root@dfbsd:/usr/obj/usr/src/sys/X86_64_GENERIC x86_64",
  "runtime_sec": 15,
  "guest_dirty": 0,
  "build_cmd": "cc -Wall -O2 -o df3765_max_indx df3765_max_indx.c",
  "run_cmd": "./df3765_max_indx /dev/dri/renderD128",
  "code_hash": "27c745dae09a98d500883525c73689f1a74aea4fe6279b7733be3f3daf593890",
  "notes": "Guest is virtio-only (no ATI ASIC, no radeonkms module, no /dev/dri) - runtime execution impossible; module presence documented in env.txt. Source-level proof is line-exact. DF-1209 (vbpntr underflow) is a separate known finding and is NOT re-reported here.",
  "recommended_fix": "Compute the PW=1 (and PW=2) vertex-array bound in 64-bit: (u64)esize * max_indx * 4",
  "fix_status": "not_testable",
  "fix_baseline_reproduced": 0,
  "fix_patched_reproduced": 0,
  "fix_verdict": "fix.diff authored from line-exact source analysis; kernel-rebuild validation impossible on this guest (no target ASIC to baseline)",
  "fix_evidence": "fix.diff in pack"
}