DF-3770 / verdict.json
{ "finding_id": "DF-3770", "status": "untested", "reproduced": 0, "impact": "none", "confidence": "certain", "verdict": "Upstream-divergence record, source-certain: the DragonFly port deleted the pre-B3 ValleyView PPGTT disable from intel_sanitize_enable_ppgtt (present verbatim in Linux v4.19; captured in upstream_v419_diff.txt). On VLV B0/B2 silicon the driver now enables PPGTT where upstream disables it, enabling GPU-fault/hang wedging by any local render-node user on that specific 2013-era hardware; recoverable via GPU reset, no kernel memory-safety impact (walkers are bounds-correct regardless of the enable bit). Info severity. Runtime verification skipped (no VLV hardware; audit guest is virtio-only with no i915 device or module). Restore the upstream block per fix.diff.", "exploit_chain": "", "evidence": "README.md, VERDICT.md, upstream_v419_diff.txt (direct v4.19 diff showing the deleted block), fix.diff", "kernel_refs": [ "sys/dev/drm/i915/i915_gem_gtt.c:136", "sys/dev/drm/i915/i915_gem_gtt.c:158" ], "poc_changes": "n/a", "attempts": 0, "guest_uname": "DragonFly dfbsd 6.5-DEVELOPMENT #0: Thu Jul 2 06:02:54 UTC 2026 root@dfbsd:/usr/obj/usr/src/sys/X86_64_GENERIC x86_64", "runtime_sec": 0, "guest_dirty": 0, "build_cmd": "n/a", "run_cmd": "n/a", "code_hash": "", "notes": "Info finding: divergence with hardware-gated DoS potential (pre-B3 VLV only); no memory-safety consequence. Deletion looks accidental (no rationale; rest of function matches v4.19 modulo renames).", "recommended_fix": "Restore the upstream pre-B3 ValleyView disable block in intel_sanitize_enable_ppgtt — see fix.diff", "fix_status": "not_tested", "fix_baseline_reproduced": 0, "fix_patched_reproduced": 0, "fix_verdict": "fix.diff restores the upstream block verbatim; no runtime validation possible (no VLV hardware)", "fix_evidence": "findings/poc/DF-3770/fix.diff" } |