# DF-3783 — verdict

**REPRODUCED** | reproduced=1 | impact=dos | confidence=certain

REPRODUCED at source level (arithmetic harness). The verbatim-ported emission code (split/getline/notclipped + rgb_prog loop) proves the program size is 8.7x-37x the 8-page buffer for validated clip lists, and 1.25x for a plain 2046-row odd-only YUV4:2:2 geometry. Runtime kernel trigger impossible on this guest (no Bt848 hardware, driver not built); on real hardware the METEORCAPTUR ioctl linearly overwrites ~0.25-1.2 MiB of kernel heap during program build.

## Root cause (citations)
The RISC program builders (rgb_prog, rgb_vbi_prog, yuv422_prog, yuv12_prog,
yuvpack_prog) emit instructions into bktr->dma_prog / bktr->odd_dma_prog,
which are FIXED 8-page (32 KiB = 8192 dword) allocations (bktr_core.c:141,
395-396). Nothing bounds the number of emitted dwords against that capacity.

(a) CLIP LIST: BT848SCLIP (bktr_core.c:1219-1271) accepts up to 99 active
clip nodes. In rgb_prog/rgb_vbi_prog each scanline covered by clips makes the
while(getline()) loop emit one WRITE split (2 dwords) + one SKIP split (1
dword) PER NODE (bktr_core.c:2465-2534, 2536-2616). With the default 640x480
geometry and 99 validated clip nodes the program is 71,526 dwords (8.7x the
buffer, 254 KiB past the end); at max legal geometry 2046x1022 it is 304,860
dwords (37x, 1.19 MiB past the end). The overflow happens on the CPU during
the METEORCAPTUR ioctl (build_dma_prog), no DMA required.

(b) GEOMETRY ONLY: yuv422_prog emits 5 dwords/line; odd/even-only capture
(interlace=1, METEORSETGEO oformat ONLY_ODD/ONLY_EVEN) with rows=2046 emits
10,236 dwords = 8,176 bytes past the 32 KiB buffer with NO clip list at all
(bktr_core.c:3126-3133).

Overflow content is semi-controlled: OP_WRITE dwords (0x1x flags | attacker
chosen byte counts derived from clip y-ranges) interleaved with physical
addresses of bigbuf. Linear kernel-heap corruption -> panic; with heap
grooming a privesc primitive is plausible. Unprivileged: /dev/bktr0 is 0444.

## Guest reality (why no runtime kernel trigger)

The audit guest is DragonFly 6.5-DEVELOPMENT x86_64 (X86_64_GENERIC). The bktr
driver is NOT compiled into the GENERIC kernel (`sys/conf/files`: `optional
bktr pci`), there is no /boot/modules tree, no /dev/bktr*, /dev/tuner*,
/dev/vbi* nodes, no Brooktree PCI device (QEMU has no Bt848/Bt878 device
model; `pciconf -lv` shows no vendor 109e). Therefore the kernel code path is
unreachable ON THIS GUEST. Verification is source-level: faithful harnesses of
the exact kernel arithmetic (the same methodology as the accepted DF-1216
evidence pack), run on the DragonFly guest with its native cc, plus fix.diff
compile-validation against the guest's /usr/src. All PoC triggers compile
cleanly against the guest's kernel headers (poc_build_and_device_check.log).


## Exploit chain
open /dev/bktr0 (0444) -> BT848SCLIP(99 nodes) -> METEORCAPTUR -> build_dma_prog/rgb_prog writes 71k+ dwords into 8192-dword buffer -> kernel heap corruption during the ioctl (panic / groomable corruption).

## Decisive evidence
run.log: [A] 640x480 99 clips -> 71526/71526 dwords vs cap 8192 (8x, 254 KiB past end each buffer); [B] 2046x1022 -> 304860 dwords (37x, 1.19 MiB past end); [C] yuv422 odd-only rows=2046, no clips -> 10236 dwords (8176 B past end). Clip list passes the driver's own validation (rc=0, max_clip_node=99). fix_build.log: all-fpatches module builds with -Werror.

## Fix validation
fix.diff (in this directory) applies cleanly against the pristine sys/ tree
(`git apply --check`) and compiles as part of the bktr KLD module on the
guest's /usr/src with -Werror together with the seven other pass-2 bktr fixes
(fix_build.log, MAKE_RC=0, bktr.ko + bktr_mem.ko produced). Runtime
patched-behavior validation is not possible on this guest (no device), hence
fix_status=not_testable (compile-validated + logic-reviewed).

## Kernel references
- sys/dev/video/bktr/bktr_core.c:141
- sys/dev/video/bktr/bktr_core.c:395
- sys/dev/video/bktr/bktr_core.c:1219
- sys/dev/video/bktr/bktr_core.c:2465
- sys/dev/video/bktr/bktr_core.c:2536
- sys/dev/video/bktr/bktr_core.c:2857
- sys/dev/video/bktr/bktr_core.c:3126
- sys/dev/video/bktr/bktr_reg.h:455

## Fix status (batch validation)
Applied with the 36 sibling fix.diffs of this batch in findings/poc/_batch41/all_fixes.patch; single in-guest `make -j6 nativekernel KERNCONF=X86_64_GENERIC` completed RC=0 with zero errors under -Werror (full log: findings/poc/_batch41/fix_build8.log). Behavior A/B intentionally skipped for this Info-tier item.