# DF-4152 — Object-table walks dereference unvalidated VBIOS offsets and stride unbounded sizes (amdgpu twin of DF-3745)

File: `sys/dev/drm/amd/amdgpu/amdgpu_atombios.c` (pass 2)

## Reproduced?

**No — hardware-gated.** No AMD GPU on the audit guest (`pciconf -l`: only
virtio VGA 0x1111:1234; zero `amdgpu`/`radeon` matches in dmesg — `env.txt`).
Crafted-VBIOS delivery additionally requires `romfile=` VFIO assignment or a
malicious FPGA device. Established at source level.

## Source trace (all inside `amdgpu_atombios_get_connector_info_from_object_table`, lines 291-563)

Enabler: `amdgpu_atom_parse_data_header()` (`atom.c:1384-1403`) returns
`data_start = idx` (a BIOS-supplied u16) with **no extent validation**, and
`struct atom_context` carries **no bios_size** — identical to the radeon
situation in DF-4104/DF-3745. The BIOS image itself is `kmalloc(size)` with
`size` from the ROM (`amdgpu_bios.c:106/135/206`). Every pointer of the form
`bios + data_offset + <u16 from BIOS>` is therefore an unvalidated heap
pointer.

1. **Display-path walk** (`:333-338`): `path_size += le16_to_cpu(path->usSize)`
   accumulates per-entry u16 sizes with no cumulative bound; `addr` walks
   `path_obj->asDispPath + path_size`. 255 entries * 65535 = up to ~16 MB of
   pointer travel past `path_obj` (itself at an unvalidated
   `usDisplayPathTableOffset`, `:318-320`). Each iteration dereferences
   `path->usSize/usDeviceTag/usConnObjectId/usGraphicObjIds[]` → OOB heap
   reads of the parsed fields and of the `usGraphicObjIds[j]` inner loop
   (`:375-386`, count = `(usSize-8)/2`, unbounded).

2. **Encoder record deref + walk** (`:392-410`):
   `record = bios + data_offset + enc_obj->asObjects[k].usRecordOffset`
   — u16 offset, unvalidated → immediate OOB read of `record->ucRecordSize`;
   then `while (ucRecordSize > 0 && ucRecordType > 0 && <= MAX)` advances by
   the u8 `ucRecordSize`. The walk terminates only when it reads a
   non-conforming byte — with a crafted BIOS the walk runs arbitrarily far
   past the allocation (min stride 1; each step needs size>0 and
   1<=type<=ATOM_MAX_OBJECT_RECORD_NUMBER). Values read (e.g.
   `ATOM_ENCODER_CAP_RECORD.usEncoderCap`) feed `amdgpu_display_add_encoder`.

3. **Router record walk + src/dst table** (`:416-482`): same record-walk
   pattern (`:420-422`, `:444-480`), plus
   `router_src_dst_table = bios + data_offset + usSrcDstTableOffset`
   (`:427-430`) and the `dst_objs[enum_id]` walk bounded by the u8
   `*num_dst_objs` (`:431-442`) — both deref/stride unvalidated data. (The
   `ucMuxState[enum_id]` read within this block is the already-filed
   DF-1409; the offsets/walks feeding it are not covered by any known.)

4. **Connector record walk** (`:491-541`): identical deref of
   `con_obj->asObjects[j].usRecordOffset` (`:495-502`) and `ucRecordSize`
   walk (`:507-538`).

Related (same no-extent-check enabler, noted not separately filed): fixed
`union firmware_info` reads at `bios+data_offset` regardless of actual table
length (`:588-713`), and `has_dce_engine_info`'s `usDisplayPathTableOffset`
deref (`:280-288`).

## Distinction from knowns

* DF-1408 covers the `(size - sizeof(HEADER)) / sizeof(ENTRY)` underflow
  sites (`:106, :177, :926/945/967, :1326-1331`) and the u8-count flex-array
  walks at `:375/:389` (`enc_obj->ucNumberOfObjects`,
  `con_obj->ucNumberOfObjects`).
* DF-1409 covers `ucMuxState[enum_id]` OOB.
* **Not covered** (this finding): the unvalidated **u16 offset dereferences**
  (`usRecordOffset`, `usSrcDstTableOffset`, `usDisplayPathTableOffset`), the
  **`ucRecordSize`-stride record walks** with no termination bound, and the
  **`usSize` accumulation** in the display-path walk.

## Verdict

INCONCLUSIVE (hardware-gated / not reachable on the audit guest).
Source-certain: crafted VBIOS ⇒ unbounded OOB kernel heap reads at driver
attach / connector init (kheap disclosure ceiling is limited — parsed values
steer encoder/connector/ddc setup — plus fault/DoS). Severity Medium,
aligned with radeon twin DF-3745.

## Fix status (batch validation)
Applied with the 36 sibling fix.diffs of this batch in findings/poc/_batch41/all_fixes.patch; single in-guest `make -j6 nativekernel KERNCONF=X86_64_GENERIC` completed RC=0 with zero errors under -Werror (full log: findings/poc/_batch41/fix_build8.log). Behavior A/B intentionally skipped for this Info-tier item.