# DF-4588 — ttm_bo_vm_fault_dfly maps SG (prime-imported) pages via the card node; upstream refusal check is dead code

File: `sys/dev/drm/ttm/ttm_bo_vm.c` — the DFly fault `ttm_bo_vm_fault_dfly`
(lines 499-725) has **no** `TTM_PAGE_FLAG_SG` refusal. Upstream's check
(`bo->ttm && (bo->ttm->page_flags & TTM_PAGE_FLAG_SG) -> VM_FAULT_SIGBUS`,
"Refuse to fault imported pages … handled by redirecting mmap to the
exporter") sits dead inside the `#if 0`'d Linux body at lines 161-168.

Effect (radeon/amdgpu with prime import — wired on DFly: drm_ioctl.c:651-652,
amdgpu_ttm.c:1272-1280 sets TTM_PAGE_FLAG_SG for imported BOs):

* The imported BO's `ttm->pages` are the **exporter's** pages.
* `ttm_bo_vm_fault_dfly` returns them to the importer's address space
  (`m = ttm->pages[OFF_TO_IDX(offset)]`, :690; `*mres = m`, :714) through
  the *card node* mapping instead of the exporter's mmap path.
* `pmap_page_set_memattr(m, ...)` (:695-697) and
  `pmap_page_set_memattr(m, ttm_io_prot(...))` (:669) mutate the cache
  attribute of pages the TTM layer does not own — affecting every other
  mapping of those pages (exporter's CPU mapping included).

Impact: cross-driver page-attribute mutation (cache-mode downgrade /
coherency break for foreign mappings) + mapping imported pages through the
wrong node with driver-chosen attributes. Linux deliberately refuses this
fault (correctness + caching reasons); not kernel memory corruption by
itself. Low severity, hardware-gated (needs radeon/amdgpu).

## Fix

Port the upstream check into the live DFly fault:

```diff
--- a/sys/dev/drm/ttm/ttm_bo_vm.c
+++ b/sys/dev/drm/ttm/ttm_bo_vm.c
@@ -584,6 +584,14 @@ ttm_bo_vm_fault_dfly(vm_object_t vm_obj, vm_ooffset_t offset,
 		}
 	}
 
+	/*
+	 * Refuse to fault imported (SG) pages; mmap of such objects
+	 * must be handled by the exporter (upstream ttm_bo_vm_fault).
+	 */
+	if (bo->ttm && (bo->ttm->page_flags & TTM_PAGE_FLAG_SG)) {
+		retval = VM_PAGER_ERROR;
+		goto out_unlock1;
+	}
+
 	if (bdev->driver->fault_reserve_notify) {
```

PoC (`df4588.c`) is a documentation stub: the full trigger needs
amdgpu-specific GEM ioctls on real hardware. **Untested on the audit
guest** (no DRM device — same gate as DF-4587/DF-4458).