{
  "finding_id": "DF-3863",
  "title": "u32 truncation of nptes in amdgpu_vm_bo_update_mapping undersizes the update IB; amdgpu_vm_update_ptes then writes past its end (heap overflow)",
  "verdict": "not_reproduced",
  "reproduce": {
    "build": "cc -Wall -O2 -o va_nptes_overflow va_nptes_overflow.c (builds on guest, RC=0)",
    "run": "./va_nptes_overflow (needs AMD hw, default 256TB VM (gmc_v9_0.c:940) and amdgpu.vm_block_size>=16)",
    "expected": "PRT MAP 16TiB + UNMAP -> clear_freed -> nptes=(u32)(2^32)=0 -> tiny IB -> update_ptes emits one WRITE_PTE packet set per leaf -> IB heap overflow + WARN_ON(length_dw > ndw) at amdgpu_vm.c:1920 after the fact"
  },
  "kernel_refs": ["sys/dev/drm/amd/amdgpu/amdgpu_vm.c:1807", "sys/dev/drm/amd/amdgpu/amdgpu_vm.c:1841", "sys/dev/drm/amd/amdgpu/amdgpu_vm.c:1879", "sys/dev/drm/amd/amdgpu/amdgpu_vm.c:1915", "sys/dev/drm/amd/amdgpu/amdgpu_vm.c:1920", "sys/dev/drm/amd/amdgpu/amdgpu_vm.c:2006", "sys/dev/drm/amd/amdgpu/amdgpu_vm.c:2333", "sys/dev/drm/amd/amdgpu/amdgpu_gem.c:604", "sys/dev/drm/amd/amdgpu/gmc_v9_0.c:940"],
  "artifacts": ["README.md", "VERDICT.md", "va_nptes_overflow.c", "build.sh", "run.sh", "build.log", "run.log", "env.txt", "fix.diff", "manifest.json", "verdict.json"]
}