# DF-4447 — VCE reloc dword aliasing desync / infinite loop

* **Target:** `sys/dev/drm/amd/amdgpu/amdgpu_vce.c` — `amdgpu_vce_ring_parse_cs`
  second loop + `amdgpu_vce_cs_reloc`
* **Class:** parser desync → infinite kernel loop (CWE-835) + skipped
  validation pass
* **Reach:** unprivileged local user, `/dev/dri/renderD128`, AMDGPU CS ioctl
  (`AMDGPU_HW_IP_VCE`) on CIK/Tonga/Fiji-class GPUs (`vce_v2_0_ip_block`)

## Contents

* `vce_cs_desync.c` — dword-exact trigger (render node → GEM VRAM bo → GEM_VA
  map at 32 GiB → CS submissions sweeping the mapping delta; the hit
  submission never returns)
* `VERDICT.md` — full line-trace narrative, exploit arithmetic, kill/verify notes
* `fix.diff` — per-command minimum length checks (git-apply-able, authored
  against the read-only sys/ tree; never applied there)
* `env.txt` — guest environment (no AMD GPU → untestable)

## Reproduce (on hardware with a VCE 2.0-era AMD GPU)

    cc -O2 -o vce_cs_desync vce_cs_desync.c
    ./vce_cs_desync /dev/dri/renderD128

Expected: within ≤1024 submissions the process hangs inside the CS ioctl
(unkillable, D-state; `procstat -kk` shows the thread in
`amdgpu_vce_ring_parse_cs`); each hung submission pins one CPU at 100%.

On the audit QEMU guest this **cannot run** (no AMD GPU, no /dev/dri) — see
`VERDICT.md` for the source-level proof.