{
  "finding_id": "DF-3852",
  "status": "inconclusive",
  "reproduced": 0,
  "impact": "none",
  "confidence": "certain",
  "verdict": "Source-certain: radeon_combios_get_power_modes() takes the voltage-GPIO MMIO register index raw from the VBIOS (RBIOS16(...)*4, no range check, radeon_combios.c:2748-2760) and r100_pm_misc() (r100.c:352-364) later executes RREG32/WREG32 at that offset on every PM clock transition; offsets >= rmmio_size (64KB BAR) are re-routed by r100_mm_wreg_slow() into RADEON_MM_INDEX with the raw attacker offset (0x3FFFC max) -> out-of-BAR indexed device register RMW; in-range values give an arbitrary in-BAR register RMW with a BIOS-chosen mask bit. Harness (kernel logic replicated 1:1) proves the primitive deterministically: BIOS word 0xffff -> MM_INDEX 0x3fffc. Kernel-side execution not observable: audit guest is virtio-only, 0 radeon devices (env.txt), so runtime reproduction is impossible on this host. Expected impact on target hw: arbitrary GPU-register corruption incl. clock/aperture/window registers (GPU hang/brick; potential second-stage GART abuse by an unprivileged DRM client). Not host kernel memory corruption by itself.",
  "exploit_chain": "crafted VBIOS on pre-AVIVO mobility board -> combios powerplay parse at load (misc bit 0x4 = ATOM_PM_MISCINFO_VOLTAGE_DROP_SUPPORT enables both parse and sink) -> first PM clock transition executes r100_pm_misc() RREG32/WREG32 RMW at BIOS-chosen offset (up to 0x3FFFC via MM_INDEX) with BIOS-chosen mask -> device register corruption (further GART/aperture abuse would chain via unprivileged DRM command submission)",
  "evidence": "run.log: [slow] WREG32: MM_INDEX <- 0x0003fffc (>= rmmio_size 0x10000) -> indexed write OUTSIDE the MMIO BAR + PRIMITIVE PROVEN line; VERDICT.md path:line trace; fix_apply.log proves fix.diff applies to pristine /usr/src",
  "kernel_refs": [
    "sys/dev/drm/radeon/radeon_combios.c:2739-2763",
    "sys/dev/drm/radeon/radeon_combios.c:2748-2752",
    "sys/dev/drm/radeon/radeon_combios.c:2754-2760",
    "sys/dev/drm/radeon/r100.c:345-364",
    "sys/dev/drm/radeon/r100.c:4125-4138",
    "sys/dev/drm/radeon/radeon_pm.c:219-241",
    "sys/dev/drm/radeon/atombios.h:7620"
  ],
  "poc_changes": "harness replicates kernel parse + sink 1:1 (no seed existed); fixed a missing <stdbool.h> for DragonFly cc 8.3 default C standard (first build failed, see notes)",
  "attempts": 2,
  "guest_uname": "DragonFly dfbsd 6.5-DEVELOPMENT DragonFly 6.5-DEVELOPMENT #0: Thu Jul  2 06:02:54 UTC 2026     root@dfbsd:/usr/obj/usr/src/sys/X86_64_GENERIC  x86_64",
  "runtime_sec": 25,
  "guest_dirty": 0,
  "build_cmd": "./build.sh (cc -O2 -Wall -o harness harness.c)",
  "run_cmd": "./run.sh",
  "code_hash": "3bd2c373dadc2a77893a590895117af87317d049da3226915132f83ba5dca371",
  "notes": "Guest virtio-only (dmesg: 0 radeon lines) - kernel path hardware-gated, hence status=inconclusive rather than reproduced/not_reproduced. Distinct from DF-1251 (that is OOB-read garbage into WREG32 at init; this is in-bounds data executed at PM time as a register INDEX) and from DF-1252 (that is the OOB read of voltage_table_offset; this assumes the read is in-bounds and attacks the derived index). Same bug exists upstream (verified Linux v5.10).",
  "recommended_fix": "Validate gpio.reg < 0x10000 and mask bit < 32 in both rev paths of the combios powerplay voltage-GPIO parse; mark the record invalid otherwise (fix.diff)",
  "fix_status": "not_testable",
  "fix_baseline_reproduced": 0,
  "fix_patched_reproduced": 0,
  "fix_verdict": "fix.diff authored against pristine sys/ and apply-verified on the guests /usr/src copy (fix_apply.log: hunk #1 succeeded at 2746); runtime baseline/patched comparison impossible on this guest (no radeon hardware), so fix validation is apply+review only",
  "fix_evidence": "fix.diff; fix_apply.log"
}