# DF-4679 — i915 stolen reserved-base above stolen_top: u64 size wrap
bypasses the containment check and inflates stolen_usable_size

`sys/dev/drm/i915/i915_gem_stolen.c` — `g4x_get_stolen_reserved()`
(:201-229) and `bdw_get_stolen_reserved()` (:349-366) compute
`*size = stolen_top - *base` from the BIOS-programmed STOLEN_RESERVED
register; `i915_gem_init_stolen()` (:470-503) then trusts it.

## Build (on the DragonFly guest)

```
cd /root/df4679 && sh build.sh
```

The guest has no Intel GPU, so the driver-attach path cannot run; instead the
harness transcribes the **exact** inline helpers from
`include/linux/pci.h:621-642` and both register masks, and `build.sh`
**grep-verifies every transcribed kernel line against the guest's /usr/src**
(`SOURCE_LINES_VERIFIED` in build.log) before compiling.

## Run

```
./i915_stolen_harness          # BASELINE (pristine :475 logic)
./i915_stolen_harness fixed    # with fix.diff's guard active
```

## Expected (baseline)

```
== G4X garbage reserved base (0xABC -> 0x0ABC0000) ==
  resource_contains     : PASS            <- containment check bypassed
  stolen_usable_size    : 2867855360 (85.47x the real 33554432)
  worst-case alloc phys : 0xabbfffff (dsm.end=0x2cfffff => OUTSIDE stolen)
  DF-4679 REPRODUCED: ...
== BDW garbage reserved base (0xFFF -> 0xFFF00000) ==  (95.97x)
```

A reserved base above `stolen_top` makes `stolen_top - *base` wrap mod 2^64
(`resource_size_t` = uint64_t); `DEFINE_RES_MEM` then computes
`dsm_reserved.end == stolen_top - 1 == dsm.end`, so
`resource_contains(&dsm, &dsm_reserved)` at :485 **passes** even though the
reservation starts above stolen — and `stolen_usable_size` (:499-500)
inflates up to ~96x the real region, so `drm_mm_init(0, usable)` (:503)
hands out offsets beyond `dsm.end` and
`i915_pages_create_for_stolen` (:516,:536) points the GPU at physical memory
outside stolen (the `GEM_BUG_ON(range_overflows(...))` at :516 is a no-op in
release builds — i915_gem.h:38-61).

The sane-firmware control case behaves normally (usable 0.97x real),
isolating the wrap as the cause. **Threat model: malicious/buggy BIOS (or
root pre-attach) — not reachable by an unprivileged local user.**

## Fix validation

`fix.diff` extends the existing :475 sanity check to
`if (!reserved_base || reserved_base > stolen_top)`. In the FIXED run both
garbage cases produce `usable == real` with allocations inside stolen; the
control case is unchanged.