# DF-3863 VERDICT — not_reproduced (hardware-gated + config-gated); truncation certain at source

## Runtime

Guest has no AMD GPU (`/dev/dri` absent — env.txt); the GEM_VA ioctl does not
exist here. status = not_reproduced, reproduced = 0.

## Source-level certainty of the sink

- amdgpu_vm.c:1807 `unsigned nptes, ncmds, ndw;`
- amdgpu_vm.c:1841 `nptes = last - start + 1;` (u64 → u32 truncation)
- amdgpu_vm.c:1850-1879 `ncmds`/`ndw` derived from the truncated nptes;
  `amdgpu_job_alloc_with_ib(adev, ndw * 4, &job)` sizes the IB.
- amdgpu_vm.c:1915 `amdgpu_vm_update_ptes(&params, start, last + 1, ...)`
  receives the FULL u64 range; its loop (1670-1777) emits one packet set per
  page-table leaf; `amdgpu_vm_write_pte`/`set_pte_pde`
  (amdgpu_vm.h:292-293) append to `ib->ptr[]` without any bounds check.
  The only guard is post-hoc: `WARN_ON(params.ib->length_dw > ndw)`
  (amdgpu_vm.c:1920) — i.e. the overflow has already happened.
- Single-call giant ranges reach this function from:
  * amdgpu_vm.c:2333-2335 (`amdgpu_vm_clear_freed` — whole freed mapping),
  * amdgpu_vm.c:2003-2007 + 2037-2040 (`split_mapping` with `nodes == NULL`,
    i.e. the BO-less PRT mapping path `fpriv->prt_va`, amdgpu_gem.c:630-631,
    `max_entries = S64_MAX`).

## Gating analysis (why not reproduced and how narrow it is)

- VM size: default on VEGA10+ is 256 TB (gmc_v9_0.c:940) → max_pfn = 2^36
  pages > 2^32 — the address space allows a 2^32-page mapping.
- PT footprint: `amdgpu_vm_alloc_pts` must cover the whole span (invoked in
  the ioctl before `amdgpu_vm_bo_map`, amdgpu_gem.c:638-641). With default
  block_size 9 that is ~8.4M PT BOs → allocation fails long before the
  mapping exists → bug not reachable in default config.
- With `amdgpu_vm_block_size >= 16` (root-set loader tunable;
  amdgpu_device.c:819-832 validates only the lower bound 9) a 16 TiB span
  needs ≤ 2^16 leaf PTs (~256 MB VRAM) — feasible; the MAP(PRT)+UNMAP pair
  then drives the truncated `nptes`.
- Linux v4.20 and v5.0 carry the identical `unsigned nptes` (verified from
  upstream sources); the design was replaced in the 5.3 VM rework. Filed Low
  due to the configuration gate; severity would be High (unprivileged heap
  overflow with attacker-influenced packet contents) on a config where
  block_size ≥ 16.

## Fix validation

fix.diff (u64 math + capped IB alloc) `git apply --check` clean. Cannot
build/exercise on this guest: fix_status = not_testable.

## Fix status (batch validation)
Applied with the 36 sibling fix.diffs of this batch in findings/poc/_batch41/all_fixes.patch; single in-guest `make -j6 nativekernel KERNCONF=X86_64_GENERIC` completed RC=0 with zero errors under -Werror (full log: findings/poc/_batch41/fix_build8.log). Behavior A/B intentionally skipped for this Info-tier item.