{
  "finding_id": "DF-4181",
  "status": "inconclusive",
  "reproduced": 0,
  "impact": "none",
  "confidence": "certain",
  "verdict": "Source-certain missing size validation: radeon_user_framebuffer_create (radeon_display.c:1311) / radeon_framebuffer_init (radeon_display.c:1294) never compare the requested scanout image size against the backing GEM object; the DRM cores framebuffer_check (drm_framebuffer.c:165-275) only enforces format validity, pitch>=width*cpp (:211) and height*pitch+offsets<=UINT_MAX (:208) and never sees the object. A 16 KiB BO therefore backs a 1920x1080 XRGB8888 fb (8,294,400 B); the display engine then scans out ~8 MB past the object end in VRAM, disclosing adjacent VRAM contents (other applications buffers) on the physical display; the flip path repeats this with the undersized pinned BO (radeon_display.c:524-539). amdgpu_display.c:523 has the identical gap in this tree (pre-drm_gem_fb vintage). Not exercisable on this guest: no GPU, no /dev/dri (run.log).",
  "exploit_chain": "",
  "evidence": "VERDICT.md (core-vs-driver responsibility trace); rfb_oob.c (CREATE_DUMB 64x64 + ADDFB2 1920x1080; success criterion: ADDFB2==0 bug vs -EINVAL fixed); run.log (no GPU, build OK); fix.diff + fix_build.log (radeon.ko built -Werror with fix)",
  "kernel_refs": [
    "sys/dev/drm/radeon/radeon_display.c:1311",
    "sys/dev/drm/radeon/radeon_display.c:1294",
    "sys/dev/drm/radeon/radeon_display.c:524",
    "sys/dev/drm/drm_framebuffer.c:165",
    "sys/dev/drm/drm_framebuffer.c:208",
    "sys/dev/drm/drm_framebuffer.c:211",
    "sys/dev/drm/amd/amdgpu/amdgpu_display.c:523"
  ],
  "poc_changes": "n/a (first-pass PoC authored in this run; raw ioctls, no libdrm dependency)",
  "attempts": 1,
  "guest_uname": "DragonFly dfbsd 6.5-DEVELOPMENT #0: Thu Jul  2 06:02:54 UTC 2026 x86_64",
  "runtime_sec": 10,
  "guest_dirty": 1,
  "build_cmd": "cc -O -Wall -o rfb_oob rfb_oob.c",
  "run_cmd": "./rfb_oob /dev/dri/card0",
  "code_hash": "d129663a50a8d9a7a13b2bb42bcdfcd7ba13cb53e79c7e40cd0fbf617e972d06",
  "notes": "Unprivileged-reachable on any radeon KMS desktop (DRM master via logind). Impact ceiling: visual/physical-display disclosure of adjacent VRAM; no kernel memory involved, no write primitive. Same-shape gap present in amdgpu_display.c:523 (out of this files scope, noted for follow-up).",
  "recommended_fix": "Per-plane check in radeon_framebuffer_init: offsets[i] + pitches[i]*DIV_ROUND_UP(height, vsub) must be <= radeon_bo_size(obj), else -EINVAL.",
  "fix_status": "inconclusive",
  "fix_baseline_reproduced": 0,
  "fix_patched_reproduced": 0,
  "fix_verdict": "Compile-validated only: fix.diff applied cleanly and radeon.ko built with -Werror as part of the batch nativekernel build (fix_build.log: radeon_display.c compiled, --- radeon.ko --- linked, zero errors). Behavioral test impossible on this guest (no GPU).",
  "fix_evidence": "fix_build.log excerpt (radeon_display.c -Werror KLD_MODULE compile + radeon.ko link)."
}