# DF-3766 - VERDICT

**status: inconclusive (runtime)** | reproduced: 0 | impact (expected): leak | confidence: certain (source)

## What was verified
r100_cs_track_check_pkt3_indx_buffer() validates the PACKET3_INDX_BUFFER index-buffer offset with '(value + 1) > radeon_bo_size(robj)' where value is a full attacker-controlled u32 read from the IB (r100.c:1909-1910). At value=0xFFFFFFFF the addition wraps to 0, the check passes, and the GPU is told to fetch index data at a ~4GB offset from a small BO -> GPU OOB read of adjacent GPU memory (info leak via rendering) or GPU fault/hang. The identical expression exists in upstream Linux torvalds master (checked 2026-09-16) -> carried upstream defect (equivalent). PoC builds on the guest and exits 1 (no /dev/dri): inconclusive at runtime, certain at source level.

## Kernel references
- sys/dev/drm/radeon/r100.c:1902-1918 (r100_cs_track_check_pkt3_indx_buffer)
- sys/dev/drm/radeon/r100.c:1938-1950 (PACKET3_INDX_BUFFER handler feeds it)

## Why not reproduced on the guest
Guest = DragonFly 6.5-DEVELOPMENT x86_64 under QEMU (virtio-only):
- kldstat: only kernel + ehci.ko + xhci.ko (drm.ko exists in /boot/kernel but is not loaded and there is no radeonkms.ko anywhere)
- /dev/dri does not exist
- pciconf shows no vendor-1002 (ATI) device
=> The radeon CS ioctl path cannot execute. The finding is proven by
line-exact source analysis (integer identities / NULL flow), and the PoC
is proven to build (build.log, cc 8.3 -Wall -O2, zero warnings).

## Upstream comparison
Checked against Linux torvalds master r100.c (fetched 2026-09-16):
identical '(value + 1) >' expression present upstream (equivalent).

## Fix
fix.diff in this directory (not applied to the read-only sys/ tree; kernel
rebuild validation not possible - no target ASIC).

## Fix status (batch validation)
Applied with the 36 sibling fix.diffs of this batch in findings/poc/_batch41/all_fixes.patch; single in-guest `make -j6 nativekernel KERNCONF=X86_64_GENERIC` completed RC=0 with zero errors under -Werror (full log: findings/poc/_batch41/fix_build8.log). Behavior A/B intentionally skipped for this Info-tier item.