{
  "finding_id": "DF-4255",
  "title": "agp_i915_write_gtt programs GTT PTEs into the MMADR register BAR (sc_res[0]) instead of GTTADR (sc_res[1]): register corruption incl. PGTBL_CTL hijack at PTE index 0x808, and OOB write past the mapped MMADR resource for PTE indices >= 32768 (aperture > 128MB)",
  "verdict": "inconclusive",
  "impact_source_level": "hardware-gated kernel memory corruption / GPU physical-map hijack; unprivileged GEM bind triggers it",
  "reproduce": {
    "build": "cc -O2 -Wall -o trigger trigger.c",
    "run": "./trigger   (requires 915G/945G/E7221/945GM/945GME + i915 KMS active)",
    "expected": "GPU faults / PGTBL_CTL corruption in dmesg on any aperture; kernel instability once binds cross GTT index 32768 with a 256MB aperture"
  },
  "kernel_refs": [
    "sys/dev/agp/intel-gtt.c:139-143",
    "sys/dev/agp/intel-gtt.c:198-218",
    "sys/dev/agp/intel-gtt.c:998-1004",
    "sys/dev/agp/intel-gtt.c:1092-1098",
    "sys/dev/drm/i915/i915_gem_gtt.c:2691-2713",
    "sys/dev/drm/i915/i915_gem_gtt.c:3517-3554"
  ],
  "artifacts": ["trigger.c", "build.sh", "run.sh", "build.log", "run.log", "env.txt", "VERDICT.md", "fix.diff", "manifest.json", "verdict.json"],
  "code_hash": "b5222191d54434f156fbd14a0bef3b61c3cb82d93232de6be2667773ce63081a"
}