# DF-4458 — drm_gem_mmap_single passes user-controlled mmap length and in-object offset to the GEM pager without any bounds check

## Reproduce (on a GPU machine — e.g. any Intel i915 system)

```
cc -O2 -Wall -Wextra -o df4458 df4458.c
./df4458 /dev/dri/card0
```

Success criterion (vulnerable kernel): line `[A] oversized mmap(…)
SUCCEEDED` with non-`OUT OF BOUNDS`-safe page contents past page 1,
and/or `[B] offset+mmap SUCCEEDED` (mapping 2 MiB past a 1-page
object). With the core fix: both attacks return EINVAL.

## On the audit QEMU guest

`sh run.sh` — no /dev/dri exists (QEMU bochs VGA, no KMS driver), so
the PoC fails at open(); runtime reproduction is impossible. The
defect is proven by source trace (VERDICT.md: vm_mmap.c:1377 →
drm_drv.c:1270 → drm_gem.c:1099 → device_pager.c:109 → i915_gem.c:2229,
with the only upstream clamp dead at drm_gem.c:944-946 `#if 0`).

## Build (fix compile-validation)

`sh build.sh` (inside guest, fixed drm_gem.c staged) — drm.ko rebuilds
`-Werror` clean, RC=0 (build.log).

## Files

* `df4458.c` — unprivileged trigger (dumb buffer + oversized mmap +
  forged in-object offset)
* `VERDICT.md` — full hop-by-hop data-flow proof + negative results
* `fix.diff` — core-side clamp (git-apply-able; compile-validated)
* `run.log`, `env.txt`, `build.log`, `run.sh`, `build.sh`