# DF-4314 — intel_overlay: GPU-reset vs overlay-off lifetime race → NULL-crtc write / GEM_BUG_ON panic

## What

`intel_overlay_reset()` (invoked from `i915_reset()`) tears down overlay state
(`overlay->crtc = NULL`, releases `old_vma`) without regard for a concurrent,
still-in-flight `intel_overlay_off()` — whose retire callback
`intel_overlay_off_tail()` then executes `overlay->crtc->overlay = NULL` with
`overlay->crtc == NULL` (NULL+offset kernel write → page fault → panic), or
whose pending `last_flip` makes the reset's own `intel_overlay_release_old_vid()`
slowpath trip `GEM_BUG_ON()` in `intel_overlay_submit_request()` → `BUG()` →
panic.

- File: `sys/dev/drm/i915/intel_overlay.c`
- Lines: 220-221 (GEM_BUG_ON), 364-379 (`intel_overlay_off_tail`, crash at 373),
  435-475 (`intel_overlay_release_old_vid`), 477-490 (`intel_overlay_reset`)
- Reset entry: `i915_drv.c:2356` (`intel_overlay_reset` inside `i915_reset`),
  executed **from inside a sleeping overlay waiter's own wait loop**
  (`i915_request.c:1250-1260` `__i915_wait_request_check_and_reset`,
  `i915_gem_active_retire` uses `I915_WAIT_LOCKED`,
  `i915_request.h:701-722`).

## Build / Run (exact)

Guest (audit QEMU, no i915 hardware — honest device-absent run):

```
vm.sh run_root 'cc -O2 -I/usr/src/sys/dev/drm/include -o /tmp/trigger /tmp/trigger.c'
vm.sh run_root '/tmp/trigger /dev/dri/card0'
```

On real hardware (Gen2–Gen5 Intel GPU with overlay unit):

```
cc -O2 -I/usr/src/sys/dev/drm/include -o trigger trigger.c
./trigger /dev/dri/card0 &            # DRM-master overlay on/off hammer
# in parallel, as an UNPRIVILEGED user: induce GPU hangs (e.g. endless
# oversized GEM batchbuffers) so i915_reset() fires while an overlay-off
# request is pending; watch for panic in intel_overlay_off_tail / GEM_BUG_ON.
```

## Expected

- Vulnerable HW: kernel panic — either `Fatal trap 12: page fault` writing
  `0+offsetof(struct intel_crtc, overlay)` from `intel_overlay_off_tail`, or
  `GEM_BUG_ON(i915_gem_active_peek(...))` → `BUG()` from
  `intel_overlay_submit_request`.
- Audit guest (this run): trigger compiles clean; `open("/dev/dri/card0")`
  → ENOENT; exit 2. The i915 driver cannot attach (Bochs/virtio VGA only —
  `env.txt`), so the path is unreachable at runtime on this guest.

## Artifacts

- `trigger.c` — DRM-master race half (overlay on/off hammer)
- `build.log`, `run.log`, `env.txt` — full guest compile/run output + PCI/env
- `fix.diff` — verified `git apply --check`-clean two-hunk fix
- `VERDICT.md` — full narrative and code-path proof
- `manifest.json`, `verdict.json`