{
  "finding_id": "DF-4887",
  "file": "sys/dev/drm/amd/amdgpu/cik_ih.c",
  "title": "cik_ih: unvalidated device-DMA'd IH wptr (DF-4843 twin, 16-byte grid) — permanent interrupt-thread spin on misaligned wptr, plus RB_OVERFLOW recovery phase bug parking rptr within 12 bytes of ring end → up to 12-byte OOB read past the zero-slack 64 KiB GTT ring BO",
  "verdict": "untested",
  "impact": "dos",
  "severity": "Low",
  "confidence": "certain",
  "reproduce": {
    "build": "n/a — device-gated (wptr comes from GPU DMA into the writeback slot); guest has no AMD GPU (env.txt)",
    "run": "n/a",
    "expected": "if armed on CIK hardware: amdgpu ithread pegs one CPU forever re-dispatching the 64KiB ring (all GPU IRQs dead); with overflow bit + wptr phase 4..15 near ring end: first decode reads up to 12B past the ring BO"
  },
  "kernel_refs": [
    "sys/dev/drm/amd/amdgpu/cik_ih.c:190",
    "sys/dev/drm/amd/amdgpu/cik_ih.c:200",
    "sys/dev/drm/amd/amdgpu/cik_ih.c:205",
    "sys/dev/drm/amd/amdgpu/cik_ih.c:274",
    "sys/dev/drm/amd/amdgpu/cik_ih.c:287",
    "sys/dev/drm/amd/amdgpu/amdgpu_ih.c:80",
    "sys/dev/drm/amd/amdgpu/amdgpu_ih.c:154",
    "sys/dev/drm/amd/amdgpu/amdgpu_irq.c:170"
  ],
  "artifacts": ["README.md", "VERDICT.md", "trigger_sketch.c", "fix.diff", "verdict.json", "manifest.json", "env.txt"]
}