{
  "finding_id": "DF-4347",
  "status": "inconclusive",
  "reproduced": 0,
  "impact": "none",
  "confidence": "certain",
  "verdict": "Code defect certain: the amdgpu amdgpu_atom_parse tail (amd/amdgpu/atom.c:1340-1348) takes idx=CU16(0x6E) unvalidated, dereferences CSTR(idx), and walks it with printk %s and strlcpy-as-source until a NUL that may live past the bios allocation -- adjacent kernel-heap bytes are printed to the console/log and up to 19 copied into ctx->vbios_version. amdgpu twin of DF-4339 (radeon) with a worse shape (no bounded intermediate copy at all); previously unfiled for amdgpu. Kernel runtime hardware-gated; guest mirror: 512-byte image, string to the guarded image end, no NUL -> SIGSEGV exit 139 (run.log case partstr); fixed logic requires the NUL inside the image -> clean reject, exit 0 (fix_run.log).",
  "exploit_chain": "",
  "evidence": "run.log case partstr (exit=139 at the %s/strlcpy walk); fix_run.log case partstr (rejected, exit 0); fix.diff (git apply --check OK)",
  "kernel_refs": [
    "sys/dev/drm/amd/amdgpu/atom.c:1340",
    "sys/dev/drm/amd/amdgpu/atom.c:1344",
    "sys/dev/drm/amd/amdgpu/atom.c:1346",
    "sys/dev/drm/amd/amdgpu/atom.c:1347"
  ],
  "poc_changes": "amdgpu part-string shape (idx=CU16(0x6E), %s on CSTR) mirrored, not the radeon name[512] loop",
  "attempts": 2,
  "guest_uname": "DragonFly dfbsd 6.5-DEVELOPMENT DragonFly 6.5-DEVELOPMENT #0: Thu Jul  2 06:02:54 UTC 2026     root@dfbsd:/usr/obj/usr/src/sys/X86_64_GENERIC  x86_64",
  "runtime_sec": 60,
  "guest_dirty": 0,
  "build_cmd": "cc -O1 -g -o atom_harness atom_harness.c",
  "run_cmd": "./atom_harness partstr (expect 139) ; ./atom_harness_fixed partstr (expect 0)",
  "code_hash": "5356b23349edbb49469348db664a12cf6437fa43fe980eef7d322939a6da7eba",
  "notes": "Minimal standalone fix leaves a <=19-byte over-read residual when idx sits at image end; the complete fix (idx in image AND NUL in image) is in the DF-4345 central ports fix.diff",
  "recommended_fix": "Validate idx against the bios length and require the NUL terminator inside the image before printing/copying the part number (or at minimum copy bounded + force-terminate)",
  "fix_status": "inconclusive",
  "fix_baseline_reproduced": 0,
  "fix_patched_reproduced": 0,
  "fix_verdict": "fix.diff (bounded copy + forced termination) passes git apply --check; fixed-logic mirror rejects the unterminated string. No kernel runtime possible on this guest.",
  "fix_evidence": "fix.diff; fix_run.log case partstr"
}