{
  "finding_id": "DF-4255",
  "status": "inconclusive",
  "reproduced": 0,
  "impact": "none",
  "confidence": "certain",
  "verdict": "agp_i915_write_gtt (sys/dev/agp/intel-gtt.c:998-1004) writes GTT PTEs via bus_write_4(sc->sc_res[0], index*4, pte) \u2014 the MMADR register BAR \u2014 while the GTT actually lives in GTTADR (sc_res[1], mapped by agp_i915_res_spec at intel-gtt.c:139-143). The files own agp_i915_sync_gtt_pte reads the GTT from sc_res[1] (intel-gtt.c:1092-1098) and FreeBSD upstream programs res[1], proving a transcription divergence. On the six CHIP_I915 chipsets (915G/E7221/915GM/945G/945GM/945GME) every GGTT bind from unprivileged GEM use (i915_ggtt_insert_entries -> intel_gtt_insert_sg_entries -> agp_i915_install_gtt_pte) therefore writes PTEs into GPU register space: index 0x808 lands exactly on MMADR+0x2020 == AGP_I810_PGTBL_CTL, handing the GTT base register a (GEM page phys | 1) value \u2014 a GPU-side arbitrary-physical-mapping primitive; with a 256MB aperture, indices 32768-65535 write 128KB past the end of the mapped MMADR resource into adjacent kernel virtual memory. Could not be executed: the audit guest is QEMU without any Intel graphics (env.txt: no 8086 display device, agp/drm/i915 not loaded) and the trigger fails at open(/dev/dri/card0) as expected (run.log). Source-level certainty; hardware-gated verification.",
  "exploit_chain": "On affected hardware: unprivileged GEM create + execbuf -> bind at rising GGTT offsets -> PTE writes clobber MMADR register space -> index 0x808 reprograms PGTBL_CTL to attacker GEM page -> user-authored GTT (GEM mmap) maps arbitrary physical pages for the GPU -> GPU DMA read/write anywhere -> uid=0. First stage (register clobber) is unconditional on use; not exercised here for lack of hardware.",
  "evidence": "VERDICT.md (full trace + upstream contrast); build.log/run.log (guest build succeeds, /dev/dri/card0 absent -> hardware-gated); trigger.c (bind walker); fix.diff (one-line BAR restore)",
  "kernel_refs": [
    "sys/dev/agp/intel-gtt.c:139-143",
    "sys/dev/agp/intel-gtt.c:198-218",
    "sys/dev/agp/intel-gtt.c:998-1004",
    "sys/dev/agp/intel-gtt.c:1092-1098",
    "sys/dev/drm/i915/i915_gem_gtt.c:2691-2713",
    "sys/dev/drm/i915/i915_gem_gtt.c:3517-3554"
  ],
  "poc_changes": "Vendored the uapi structs/ioctl numbers directly into trigger.c (guest kernel headers pull in linux/types.h -> asm/int-ll64.h which does not exist for userland); exact layouts taken from the guests /usr/src i915_drm.h",
  "attempts": 2,
  "guest_uname": "DragonFly dfbsd 6.5-DEVELOPMENT DragonFly 6.5-DEVELOPMENT #0: Thu Jul  2 06:02:54 UTC 2026 root@dfbsd:/usr/obj/usr/src/sys/X86_64_GENERIC x86_64",
  "runtime_sec": 45,
  "guest_dirty": 0,
  "build_cmd": "cc -O2 -Wall -o /tmp/df4255_trigger /tmp/df4255_trigger.c",
  "run_cmd": "/tmp/df4255_trigger   (expects /dev/dri/card0; absent on guest -> exit 1 with No such file or directory)",
  "notes": "Hardware-gated; guest has only the QEMU virtual VGA 1234:1111 which never matches agp_i810_matches. Prior arg-order finding DF-1476/DF-2401 is a DIFFERENT defect (argument order inside intel_gtt_insert_page); this finding is the destination BAR in agp_i915_write_gtt and is independent of it.",
  "recommended_fix": "agp_i915_write_gtt: write the PTE through sc->sc_res[1] (GTTADR) as FreeBSD upstream does",
  "fix_status": "not_testable",
  "fix_baseline_reproduced": 0,
  "fix_patched_reproduced": 0,
  "fix_verdict": "fix.diff restores the upstream BAR index; cannot be validated on this guest for the same hardware-gating reason (no Intel GTT device)",
  "fix_evidence": "findings/poc/DF-4255/fix.diff (one-line sc_res[0] -> sc_res[1] in agp_i915_write_gtt)"
}