# DF-4256 VERDICT — `sc->stolen` unsigned underflow in agp_i915_get_stolen_size

## Status: inconclusive (hardware-gated; no Intel GTT device on the audit guest). Arithmetic certain at source level.

## Reproduction attempt

Checked the audit guest for any device handled by this driver:
`pciconf -l | grep 8086.*(2582|258a|2592|2772|27a2|27ae|...)` — none; agp
module not loaded (env.txt). The underflow executes only during
`agp_i810_attach` → `get_stolen_size` (intel-gtt.c:867) on real 915-class
hardware with firmware that programs GMS smaller than the page-table size.
The DragonFly kernel has no other caller.

## Analysis (why it is a real bug)

`(stolen - gtt_size)` is computed in `unsigned int` (both are `unsigned int`,
intel-gtt.c:566) with no guard at intel-gtt.c:698:

* Pineview path: for CHIP_IGD the G4X stolen encodings (0xa0/0xb0/0xc0/0xd0)
  set `stolen = 0` (intel-gtt.c:682-688) while `gtt_size` is 0+4 KB
  (intel-gtt.c:622-625, 696) → `(0u - 4u) * 1024 / 4096 == 0x3FFFFFFF`.
* 965 path: GMS=1M + PGTBL=2MB → `(1024u - 2052u)` wraps the same way.

`sc->stolen` is then only consumed as a *lower bound to refuse*:

- intel-gtt.c:1065-1067 `if (sc->stolen != 0 && index < sc->stolen) return (EINVAL);`
- intel-gtt.c:1083-1085 same in unbind.

So the corrupted value cannot widen writes; it locks out the GTT entirely
(graphics permanently broken — availability only), and the wrong
`stolen_size` propagates to i915 via `agp_intel_gtt_get` (intel-gtt.c:1445)
for stolen-range accounting.

Severity Low (needs specific/faulty firmware; impact is loss of graphics
function, not memory unsafety). Confidence: certain for the arithmetic,
speculative for the trigger precondition (well-formed BIOS avoids it).

## Fix

Validate `stolen >= gtt_size` before the subtraction and fail attach (or
clamp `sc->stolen` to 0) — see fix.diff.

## Fix status (batch validation)
Applied with the 36 sibling fix.diffs of this batch in findings/poc/_batch41/all_fixes.patch; single in-guest `make -j6 nativekernel KERNCONF=X86_64_GENERIC` completed RC=0 with zero errors under -Werror (full log: findings/poc/_batch41/fix_build8.log). Behavior A/B intentionally skipped for this Info-tier item.