{
  "finding_id": "DF-3769",
  "status": "untested",
  "reproduced": 0,
  "impact": "none",
  "confidence": "certain",
  "verdict": "Hardening gap confirmed in source: gen8_ppgtt_insert_pte_entries (i915_gem_gtt.c:1071-1082) advances idx->pdpe with a wrap check against GEN8_PML4ES_PER_PML4 (512) and its only 3lvl-appropriate bound is GEM_BUG_ON, which is a compile-time no-op in production (i915_gem.h:60). On a 3-level VM pdp->page_directory has 4 entries (i915_gem_gtt.c:768-769), so a pdpe of >=4 would be an OOB heap read feeding kmap_atomic + PTE writes. Not triggerable in this tree: the vma->pages sg count equals the drm_mm node page count within vm.total=2^32 (i915_vma.c:151-178, i915_vma.c:306), and the sg-exhaustion break at i915_gem_gtt.c:1057-1062 precedes the index advance, so the walk can never legitimately pass pdpe 3. Runtime verification skipped per contract (Info finding) and impossible on the virtio-only guest (no i915 device/module). Report so future refactors do not inherit an unguarded 4-entry array walk; upstream only fixed this by retiring the walker in v5.x.",
  "exploit_chain": "",
  "evidence": "README.md (trace + invariant proof), VERDICT.md, fix.diff",
  "kernel_refs": [
    "sys/dev/drm/i915/i915_gem_gtt.c:1075",
    "sys/dev/drm/i915/i915_gem_gtt.c:1081",
    "sys/dev/drm/i915/i915_gem_gtt.c:768",
    "sys/dev/drm/i915/i915_gem.h:60",
    "sys/dev/drm/i915/i915_gem_gtt.h:512"
  ],
  "poc_changes": "n/a",
  "attempts": 0,
  "guest_uname": "DragonFly dfbsd 6.5-DEVELOPMENT #0: Thu Jul  2 06:02:54 UTC 2026 root@dfbsd:/usr/obj/usr/src/sys/X86_64_GENERIC x86_64",
  "runtime_sec": 0,
  "guest_dirty": 0,
  "build_cmd": "n/a",
  "run_cmd": "n/a",
  "code_hash": "",
  "notes": "Info/hardening: runtime PoC intentionally skipped (no trigger path in this tree; no i915 hardware on guest). Source-level certainty about the missing runtime bound.",
  "recommended_fix": "Make the pdpe wrap level-aware: wrap (or WARN-and-stop) at i915_pdpes_per_pdp(vm) instead of GEN8_PML4ES_PER_PML4 — see fix.diff",
  "fix_status": "not_tested",
  "fix_baseline_reproduced": 0,
  "fix_patched_reproduced": 0,
  "fix_verdict": "fix.diff authored by inspection; no runtime validation possible/needed for this latent hardening item",
  "fix_evidence": "findings/poc/DF-3769/fix.diff"
}