# DF-4608 VERDICT

## Status: untested (hardware-required) — code-trace certainty

## Proof chain (all path:line)

1. `radeon_cs_ioctl` memsets the parser (radeon_cs.c:674) → chunk_relocs
   NULL by default.
2. `radeon_cs_parser_init` assigns `p->chunk_relocs` only for a
   RADEON_CHUNK_ID_RELOCS chunk (radeon_cs.c:313-315). A CS consisting of
   FLAGS+IB chunks only is fully accepted (IB length != 0 checked at :319;
   ring validity at :371 via radeon_cs_get_ring; VCE cs_parse non-NULL
   checked at :376).
3. `radeon_cs_parser_relocs` early-returns 0 when chunk_relocs == NULL
   (radeon_cs.c:83-85) — the submission is NOT rejected.
4. `radeon_cs_ib_chunk` → `radeon_cs_parse(rdev, ring, parser)`
   (radeon_cs.c:466) → `(rdev)->asic->ring[r]->cs_parse(p)`
   (radeon.h:2726) → `radeon_vce_cs_parse` for TN_RING_TYPE_VCE1/2
   (radeon_asic.c:1769, 2077).
5. `radeon_vce_cs_parse` case 0x05000005 (radeon_vce.c:646-651) (or
   encode 0x03000001 :615, context 0x05000001 :631, bitstream 0x05000004
   :638) → `radeon_vce_cs_reloc` → `relocs_chunk = p->chunk_relocs`
   (radeon_vce.c:478) → `if (idx >= relocs_chunk->length_dw)`
   (radeon_vce.c:482) dereferences NULL + offsetof(length_dw)=4 →
   unrecoverable kernel page fault → panic.
6. Comparative guards that prove intent: radeon_cs.c:846-850 (generic
   reloc path) and radeon_uvd.c:705-709 (UVD parser) both reject a missing
   relocs chunk with "No relocation chunk !". The VCE parser has no
   equivalent.

The trigger (vce_null_relocs.c) compiles clean on the guest (build.log)
and performs the ioctl; on this guest it exits at the /dev/dri open
(run.log: "No such file or directory ... this guest has no radeon GPU");
pciconf lists zero 1002: devices. Execution requires radeon hardware with
the VCE block (SI/CIK asics) — not present in the QEMU guest, matching the
audit precedent for GPU findings (cf. DF-4447). Deterministic panic when
run on affected hardware; no memory-corruption primitive (NULL fixed
offset read on x86-64 with the NULL page unmapped → page fault → panic).

## Fix

fix.diff adds the same guard radeon_uvd_cs_parse has, at the head of
radeon_vce_cs_parse. fix_status=not_testable (no radeon GPU on the audit
guest).

## Fix status (batch validation)
Applied with the 36 sibling fix.diffs of this batch in findings/poc/_batch41/all_fixes.patch; single in-guest `make -j6 nativekernel KERNCONF=X86_64_GENERIC` completed RC=0 with zero errors under -Werror (full log: findings/poc/_batch41/fix_build8.log). Behavior A/B intentionally skipped for this Info-tier item.