{
  "finding_id": "DF-4821",
  "status": "untested",
  "attempts": 0,
  "reproduced": 0,
  "impact": "panic",
  "confidence": "likely",
  "verdict": "Hardware-gated one-line hardening: radeon_ring_backup uses the hardware rptr (MMIO register or GTT writeback slot) as the FIRST ring index without ptr_mask - masking happens only after the post-increment - so any bogus u32 (wedged MMIO readback, hung GPU scribbling the writeback; backup runs BEFORE the hw reset on the sick device) reads up to 16GB past the kmapd ring BO -> kernel fault/panic during attacker-induced GPU reset. size itself is masked so the alloc is bounded. Identical upstream (v4.15 and still v6.1). Same hardware-trust family as DF-4352. No radeon GPU on guest; mask-before-loop fix.",
  "exploit_chain": "saturated GPU deadlock -> lockup reset -> backup reads raw rptr > ptr_mask -> ring[ptr] far OOB read -> kernel page fault",
  "evidence": "findings/poc/DF-4821/ (this verdict)",
  "kernel_refs": [
    "sys/dev/drm/radeon/radeon_ring.c:299",
    "sys/dev/drm/radeon/radeon_ring.c:322-324"
  ],
  "guest_uname": "",
  "code_hash": ""
}