{
  "finding_id": "DF-4256",
  "status": "inconclusive",
  "reproduced": 0,
  "impact": "none",
  "confidence": "likely",
  "verdict": "agp_i915_get_stolen_size computes sc->stolen = (stolen - gtt_size) * 1024 / 4096 in unsigned int with no guard (sys/dev/agp/intel-gtt.c:698). For Pineview with a G4X-encoded GMS value (0xa0-0xd0, where the chiptype check at 661-688 sets stolen=0) or a 965 with GMS=1M and a 2MB PGTBL, the subtraction wraps and sc->stolen becomes 0x3fffffff entries; agp_i810_bind_page/unbind_page (1065-1067/1083-1085) then reject every index (bind into stolen memory) \u2014 permanent graphics denial of service from attach on, plus a wrong stolen_size exported to i915. Not memory-unsafe (the wrapped value only widens the refused prefix). Not executable on the audit guest (no Intel GTT hardware, env.txt); arithmetic verified at source level; trigger precondition requires mis-programmed firmware.",
  "exploit_chain": "",
  "evidence": "VERDICT.md (wrap cases + consumer analysis); env.txt (hardware absent)",
  "kernel_refs": [
    "sys/dev/agp/intel-gtt.c:696-698",
    "sys/dev/agp/intel-gtt.c:661-688",
    "sys/dev/agp/intel-gtt.c:1065-1067"
  ],
  "poc_changes": "no runnable PoC exists without affected firmware; trigger.sh only observes the accounting",
  "attempts": 1,
  "guest_uname": "DragonFly dfbsd 6.5-DEVELOPMENT DragonFly 6.5-DEVELOPMENT #0: Thu Jul  2 06:02:54 UTC 2026 root@dfbsd:/usr/obj/usr/src/sys/X86_64_GENERIC x86_64",
  "runtime_sec": 5,
  "guest_dirty": 0,
  "build_cmd": "n/a",
  "run_cmd": "./trigger.sh (observation only)",
  "notes": "Distinct from known DF-1476/1477/2401: those are write-path defects; this is attach-time accounting underflow.",
  "recommended_fix": "Validate stolen >= gtt_size before the subtraction (fail attach or clamp sc->stolen to 0)",
  "fix_status": "not_testable",
  "fix_baseline_reproduced": 0,
  "fix_patched_reproduced": 0,
  "fix_verdict": "fix.diff adds the guard; hardware-gated, cannot be exercised on this guest",
  "fix_evidence": "findings/poc/DF-4256/fix.diff"
}