{
  "finding_id": "DF-4404",
  "title": "u32 integer overflow in amdgpu_uvd_cs_msg_decode defeats DPB/ctx buffer validation (GPU physical-mode OOB)",
  "file": "sys/dev/drm/amd/amdgpu/amdgpu_uvd.c",
  "lines": [531, 533, 596, 611, 666, 674, 686, 833],
  "verdict": "inconclusive (kernel-side math certain; guest has no AMD GPU to execute the ioctl path)",
  "impact_ceiling": "cross-process GPU-object / GTT host-page corruption; GPU hang DoS",
  "upstream": "torvalds/linux 05e1387d151f (+3e41d26c70b0 for the <16 half = DF-1595)",
  "reproduce": {
    "build": "./build.sh  (cc -O2 -I/usr/src/sys/dev/drm/include/uapi -I/usr/src/sys/dev/drm/include -o uvd_dim_overflow uvd_dim_overflow.c)",
    "run": "./run.sh   (/root/df4404/uvd_dim_overflow)",
    "expected": "Part A prints min_dpb_size=0 for MPEG2 width=0x80000000/height=2 with both gates PASS(bypassed); Part B prints open(/dev/dri/*) failures on the QEMU guest (no AMD GPU) and exits 2"
  },
  "kernel_refs": ["sys/dev/drm/amd/amdgpu/amdgpu_uvd.c:514-696", "sys/dev/drm/amd/amdgpu/amdgpu_uvd.c:803-878", "sys/dev/drm/amd/amdgpu/amdgpu_uvd.c:983"],
  "artifacts": ["README.md","VERDICT.md","uvd_dim_overflow.c","build.sh","run.sh","build.log","run.log","run.2.log","env.txt","fix.diff","verdict.json","manifest.json"]
}