{
  "finding_id": "DF-4405",
  "title": "amdgpu_uvd sw_init/resume trust unvalidated firmware ucode extent fields (DF-1946 family)",
  "file": "sys/dev/drm/amd/amdgpu/amdgpu_uvd.c",
  "lines": [253, 405, 408],
  "verdict": "inconclusive (arithmetic certain; guest lacks AMD GPU + trigger needs root-installed firmware)",
  "impact_ceiling": "kernel OOB read (arbitrary length) + OOB memset_io, root-gated supply chain",
  "upstream_family_root": "audit finding DF-1946 (amdgpu_ucode.c:251)",
  "reproduce": {
    "build": "./build.sh  (cc -O2 -Wall -o fw_hdr_overflow fw_hdr_overflow.c)",
    "run": "./run.sh   (/root/df4405/fw_hdr_overflow)",
    "expected": "validate=0 ACCEPTED; +8 wraps to 0 -> PAGE_ALIGN(0)=0; resume copies 0xfffffff8 bytes (4,294,938,616 OOB) ; memset 8 bytes past bo end; exit 0"
  },
  "kernel_refs": ["sys/dev/drm/amd/amdgpu/amdgpu_uvd.c:195-202", "sys/dev/drm/amd/amdgpu/amdgpu_uvd.c:250-253", "sys/dev/drm/amd/amdgpu/amdgpu_uvd.c:403-411", "sys/dev/drm/amd/amdgpu/amdgpu_ucode.c:251-260"],
  "artifacts": ["README.md","VERDICT.md","fw_hdr_overflow.c","build.sh","run.sh","build.log","run.log","run.2.log","env.txt","fix.diff","verdict.json","manifest.json"]
}