# DF-4032 — r600 texture mipmap BO bounds check is commented out (GPU OOB mip walk)

**File:** `sys/dev/drm/radeon/r600_cs.c`
**Severity:** Medium (cross-process GPU memory disclosure via texture sampling; hardware-gated)

## Root cause (path:line)

`r600_check_texture_resource()` computes the mipmap chain size with
`r600_texture_size()` (r600_cs.c:1399-1457) and then... does nothing:

```c
1602:	/* using get ib will give us the offset into the mipmap bo */
1603:	if ((mipmap_size + word3) > radeon_bo_size(mipmap)) {
1604:		/*dev_warn(p->dev, "mipmap bo too small (%d %d %d %d %d %d -> %d have %ld)\n",
1605:		  w0, h0, format, blevel, nlevels, word3, mipmap_size, radeon_bo_size(texture));*/
1606:	}
1607:	return 0;
```

The check body is commented out, so **any** texture resource is accepted regardless of the
mipmap BO size. `word3` (the user's mip offset) and `mipmap_size` (derived from
LAST_LEVEL/BASE_LEVEL/width/height/format) are otherwise unbounded (the `l0_size` check at
:1594 covers only level-0 in the *texture* BO).

The GPU texture unit then walks mip levels past the end of the mipmap BO: sampling the
texture in a subsequent draw reads adjacent GPU memory (other processes' BOs / GTT pages),
and the sampled values can be rendered into an attacker-owned target — a cross-process
info-leak. The PoC geometry (512x512 R8, 10 levels, 256-byte mipmap BO) walks
**87,125 bytes past** the BO (texmip_sim, run.log).

The size accumulation itself is also u32 (`offset += size` in r600_texture_size:1450), so
even a restored check must be u64-safe — the proposed fix in `fix.diff` restores it with
`(u64)` casts.

## Upstream status

The commented-out check is identical in current Linux master (upstream
`r600_cs.c:1603-1609` — "don't break userspace" heritage). Unfixed upstream.

## Verification (this pack)

* `texmip_sim.c` — replicates `r600_mip_minify`/`r600_texture_size` for the PoC resource
  and prints the per-level offsets: mipmap_size 87,381 bytes vs a 256-byte mipmap BO
  (run.log, executed on the guest).
* `r600_cs_poc.c` mode `texmip` — SET_RESOURCE VALID_TEXTURE submission with the two
  relocs (texture BO 1 MiB, mipmap BO 256 B) exactly as the parser expects; builds clean
  on the guest.
* Runtime hardware-gated (no radeon GPU on the audit guest — env.txt).

## Suggested fix

`fix.diff`: restore the check with 64-bit arithmetic and reject oversized mipmap
requirements.

## Fix status (batch validation)
Applied with the 36 sibling fix.diffs of this batch in findings/poc/_batch41/all_fixes.patch; single in-guest `make -j6 nativekernel KERNCONF=X86_64_GENERIC` completed RC=0 with zero errors under -Werror (full log: findings/poc/_batch41/fix_build8.log). Behavior A/B intentionally skipped for this Info-tier item.