{
  "finding_id": "DF-4453",
  "status": "untested",
  "reproduced": 0,
  "impact": "none",
  "confidence": "certain",
  "verdict": "intel_opregion_setup() maps the firmware-supplied RVDA VBT pointer with pmap_mapbios(rvda, rvds) (intel_opregion.c:1029-1043) with no validation of the 64-bit physical address or the 32-bit length (up to 4 GiB-1) and no rvda+rvds overflow check. DragonFlys pmap_mapbios (pmap.c:6180) maps any physical address WB-cached into KVA and cannot fail gracefully - its only failure mode is panic(pmap_mapdev: Couldnt alloc kernel virtual memory) (pmap.c:6208). The mapping is re-established on every resume (i915_drv.c:2124) while iounmap never releases pmap_mapbios KVA (the DF-1629 mechanism), so each suspend/resume cycle leaks up to rvds bytes of KVA and PTEs - an unbounded amplification of DF-1629 by firmware-chosen size. Not runtime-testable on this audit guest: it has no Intel GPU, so the i915 driver never attaches and no OpRegion exists (the ASLS config read returns 0 -> -ENOTSUPP at intel_opregion.c:980-983). Downstream safety verified by inspection: a failed map (NULL) is rejected by intel_bios_is_valid_vbts NULL check (intel_bios.c:1655), and the BDB block walks live in intel_bios.c, not in this file.",
  "exploit_chain": "",
  "evidence": "README.md; fix.diff. Key lines: intel_opregion.c:1029-1043 (unvalidated pmap_mapbios of rvda/rvds), pmap.c:6179-6213 (pmap_mapbios semantics, panic-only failure), i915_drv.c:2124 (re-map on every resume).",
  "kernel_refs": [
    "sys/dev/drm/i915/intel_opregion.c:1029",
    "sys/platform/pc64/x86_64/pmap.c:6180",
    "sys/dev/drm/i915/i915_drv.c:2124",
    "sys/dev/drm/i915/intel_bios.c:1655"
  ],
  "poc_changes": "No PoC produced: hardware-preconditioned (Intel GPU + ACPI OpRegion firmware data), absent on the QEMU audit guest.",
  "attempts": 0,
  "guest_uname": "DragonFly dfbsd 6.5-DEVELOPMENT DragonFly 6.5-DEVELOPMENT #0: Thu Jul  2 06:02:54 UTC 2026     root@dfbsd:/usr/obj/usr/src/sys/X86_64_GENERIC  x86_64",
  "runtime_sec": 0,
  "guest_dirty": 0,
  "build_cmd": "",
  "run_cmd": "",
  "code_hash": "",
  "notes": "Firmware-trust boundary finding (malicious/compromised VBIOS-SMM or reflashed OpRegion). Complements DF-1629 (do-not-re-report list): different code point (rvda mapping vs header mapping) and different mechanism (unvalidated size/address, panic-capable KVA exhaustion vs silent per-cycle leak).",
  "recommended_fix": "Validate rvds against a sane maximum (e.g. 4 MiB) and rvda+rvds for overflow before pmap_mapbios, falling back to the mailbox-#4 VBT (see fix.diff).",
  "fix_status": "not_testable",
  "fix_baseline_reproduced": 0,
  "fix_patched_reproduced": 0,
  "fix_verdict": "No Intel GPU on the audit guest: i915 never attaches, so neither baseline nor patched behavior is exercisable. Fix is by inspection (mirrors upstream Linux practice of bounding the rvda mapping).",
  "fix_evidence": "findings/poc/DF-4453/fix.diff (git-apply-able against sys/)."
}