# VERDICT — DF-3945

## Bottom line
**not_reproduced on the audit guest (no Intel Gen9 GPU; virtio-gpu only) —
carriage of CVE-2019-14615 is certain by source equivalence.**

## Proof of carriage
1. Upstream stable history (github gregkh/linux, path
   drivers/gpu/drm/i915/intel_lrc.c, linux-4.19.y): the newest post-2018
   commit touching this file is dd4f3b3508f6 (2020-01-14), the backport of
   bc8a76a152c5 fixing CVE-2019-14615. Its full 9-line patch adds a
   `WaClearSlmSpaceAtContextSwitch:skl,bxt,kbl,glk,cfl` pipe control to
   `gen9_init_indirectctx_bb` between `gen8_emit_flush_coherentl3_wa()` and
   `emit_lri()`. Fetched and diffed against this tree:
   - intel_lrc.c:1581 `batch = gen8_emit_flush_coherentl3_wa(engine, batch);`
   - intel_lrc.c:1583 `batch = emit_lri(batch, lri, ARRAY_SIZE(lri));`
   — nothing in between. The patch's exact insertion context matches our file
   (the 4.19.y patch hunk pre-context "WaFlushCoherentL3CacheLinesAtContextSwitch:skl,bxt,glk"
   is at our :1580).
2. Our snapshot otherwise includes everything else from that stable history:
   the Nov 2018 write-serialisation mb() (0a823e8fd4fd) and the Dec 2018
   Braswell full-mb (cf66b8a0ba14) are both present verbatim in
   `execlists_update_context()` (intel_lrc.c:440-456). So the CVE fix is the
   one carried gap, not a wholesale version skew.
3. Gen8's cleardown exists in-tree (intel_lrc.c:1509-1517), matching the
   upstream commit message ("this workaround is already in place for gen8");
   Gen9's is absent, and the only Gen9 pipe control resembling it is
   A0-stepping-gated (intel_lrc.c:1587 `IS_KBL_REVID(..., 0, KBL_REVID_A0)`),
   which does not cover production SKL/KBL/BXT/GLK/CFL steppings.

## Impact
Cross-context GPU info disclosure on Intel Gen9 (SKL/KBL/BXT/GLK/CFL) when
two security domains share the GPU (multi-user machine, containers, or
unprivileged user vs setuid GPU consumer). Intel PSIRT-TA-201910-001 /
CVE-2019-14615, NVD Medium. Confidentiality-only, local, requires Gen9
hardware — hardware-gated for this audit guest (env.txt: no /dev/dri,
virtio-gpu 1af4:1100).

## Hunt-list cross-check (intel_lrc.c pass 2)
- (a) context pin/unpin lifetimes: `execlists_context_pin`/`unpin`/`destroy`
  (:1288-1414) balanced; `ce->state` NULL-guard present (upstream
  "Check for ce->state before destroy" carried, :1292); request holds
  hw_context ref through `execlists_reset` (:1983).
- (b) priolist RB walks: `lookup_priolist`/`__unwind_incomplete_requests`/
  `execlists_schedule` DFS match upstream 4.19-rc; alloc-failure→priority-bump
  (:293-308) and default_priolist embedding are stock.
- (c) LRI emission: all ring_begin() sizes match emitted dword counts
  (emit_pdps 18/18, bb_start 6/6, flush 4/4, flush_render len-exact,
  breadcrumbs 6+2 and 8+2); emit_lri count ≤63 guarded (:1541).
- (d) wa-tail/tail writebacks: `unwind_wa_tail`/`gen8_emit_wa_tail` wrap via
  intel_ring_wrap (:319-323, :2233-2239) — the "Wrap around the tail offset"
  stable fix is carried.
- (e) upstream CVEs: 0a823e8fd4fd and cf66b8a0ba14 carried (mb() at :455);
  CVE-2019-14615 NOT carried → this finding. No other intel_lrc.c CVEs exist
  in the 4.19.y history (checked the full per-path commit list).

## Fix validation
Not possible on this guest (no Gen9 GPU): fix_status=not_testable.
fix.diff is the upstream fix adapted to this tree's i915_scratch_offset() API,
`git apply --check` clean.

## Fix status (batch validation)
Applied with the 36 sibling fix.diffs of this batch in findings/poc/_batch41/all_fixes.patch; single in-guest `make -j6 nativekernel KERNCONF=X86_64_GENERIC` completed RC=0 with zero errors under -Werror (full log: findings/poc/_batch41/fix_build8.log). Behavior A/B intentionally skipped for this Info-tier item.