{
  "finding_id": "DF-3766",
  "status": "inconclusive",
  "reproduced": 0,
  "impact": "leak",
  "confidence": "certain",
  "verdict": "r100_cs_track_check_pkt3_indx_buffer() validates the PACKET3_INDX_BUFFER index-buffer offset with (value + 1) > radeon_bo_size(robj) where value is a full attacker-controlled u32 read from the IB (r100.c:1909-1910). At value=0xFFFFFFFF the addition wraps to 0, the check passes, and the GPU is told to fetch index data at a ~4GB offset from a small BO -> GPU OOB read of adjacent GPU memory (info leak via rendering) or GPU fault/hang. The identical expression exists in upstream Linux torvalds master (checked 2026-09-16) -> carried upstream defect (equivalent). PoC builds on the guest and exits 1 (no /dev/dri): inconclusive at runtime, certain at source level.",
  "exploit_chain": "",
  "evidence": "VERDICT.md (full narrative); df3766_indx_wrap.c (trigger); build.log (clean compile, cc 8.3 -Wall -O2); run.log (device absent); env.txt (guest has no radeon hw/module); fix.diff",
  "kernel_refs": [
    "sys/dev/drm/radeon/r100.c:1902-1918 (r100_cs_track_check_pkt3_indx_buffer)",
    "sys/dev/drm/radeon/r100.c:1938-1950 (PACKET3_INDX_BUFFER handler feeds it)"
  ],
  "poc_changes": "Re-seeded PoC from scratch: DF-style _IOWR(d, nr, type) ioctl encoding (uapi drm.h:800), self-contained uapi structs, packet builders verified against r100d.h/radeon_reg.h constants, register reachability verified against r100_reg_safe.h bitmap (102 entries).",
  "attempts": 1,
  "guest_uname": "DragonFly dfbsd 6.5-DEVELOPMENT DragonFly 6.5-DEVELOPMENT #0: Thu Jul  2 06:02:54 UTC 2026 root@dfbsd:/usr/obj/usr/src/sys/X86_64_GENERIC x86_64",
  "runtime_sec": 15,
  "guest_dirty": 0,
  "build_cmd": "cc -Wall -O2 -o df3766_indx_wrap df3766_indx_wrap.c",
  "run_cmd": "./df3766_indx_wrap /dev/dri/renderD128",
  "code_hash": "487bf84fa5e4d3b09be44cef5d2d76c039303edd4229a8353cb6502c63a94849",
  "notes": "Guest is virtio-only (no ATI ASIC, no radeonkms module, no /dev/dri) - runtime execution impossible; module presence documented in env.txt. Source-level proof is line-exact. DF-1209 (vbpntr underflow) is a separate known finding and is NOT re-reported here.",
  "recommended_fix": "Use wrap-free comparison: value >= radeon_bo_size(robj) instead of (value+1) > size",
  "fix_status": "not_testable",
  "fix_baseline_reproduced": 0,
  "fix_patched_reproduced": 0,
  "fix_verdict": "fix.diff authored from line-exact source analysis; kernel-rebuild validation impossible on this guest (no target ASIC to baseline)",
  "fix_evidence": "fix.diff in pack"
}