# DF-4891 VERDICT — REPRODUCED (in-kernel primitive), fix validated

## Bottom line

DragonFly's `DIV_ROUND_DOWN_ULL(x,n)` compat shim
(sys/dev/drm/include/linux/kernel.h:61) computes `(x/n)*n` instead of Linux's
`do_div`-truncated `x/n`. Its sole in-tree user is `clip_scaled()`
(sys/dev/drm/drm_rect.c:64). Consequently every **1:1 or downscaled** plane
update that gets clipped by `drm_rect_clip_scaled()` receives a source
rectangle whose width/height are `(src*(dst-diff)/dst)*dst mod 2^32` — up to
~2^32 units and effectively attacker-chosen — written back into
`plane_state->src` (drm_rect.c:90/98/106/114) **after** the DRM core already
validated the original src against the framebuffer (drm_atomic.c:573-586,
drm_plane.c:623-636) and **without** any later fb-bounds re-validation on the
i915 sprite paths.

## What was executed (guest, stock kernel)

`df4891.ko` (MODULE_DEPEND on drm) called the real exported
`drm_rect_clip_scaled()` from the guest's stock drm.ko with three
unprivileged-SetPlane geometries (1920x1080 fb, 1:1 and 2:1 planes,
left/top and right/bottom CRTC clips):

| case | kernel (stock) src rect | Linux semantics | verdict |
|---|---|---|---|
| A 1:1 top-left clip | x1=y1=INT_MAX, w=h= -30848/-31688 px (inverted) | x1=480px,y1=270px, w=1440px,h=810px (in fb) | DIVERGENCE |
| C 1:1 bottom-right clip | w=12288px, h=22832px on a 1920x1080 fb | w=1440px, h=810px (in fb) | DIVERGENCE |
| D 2:1 downscale left clip | x1=INT_MAX (inverted) | x1=960px, w=960px (in fb) | DIVERGENCE |

All three: `visible=1` — the plane is accepted; the corrupted src is what the
driver would program. See `run.log`.

## Sink trace (code-level; hardware absent on this guest)

`drm_atomic_helper_check_plane_state()` (drm_atomic_helper.c:790) stores the
corrupted src into `plane_state->src`; callers:

* VLV/CHV sprites: `vlv_sprite_check` intel_sprite.c:1195 →
  `intel_plane_check_src_coordinates` intel_sprite.c:255 (pixel-snap only —
  Case A/D snap to src_x=32767px) → `i9xx_check_plane_surface`
  intel_display.c:3312 (no src bounds check) →
  `intel_compute_aligned_offset` intel_display.c:2410
  (`offset = *y * pitch + *x * cpp`, u32 wrap) → DSPSURF/DSPADDR/SPSIZE.
  Case C programs a 12288px-wide viewport on a 1920px-wide fb: the display
  engine scans ~4x past the fb row into adjacent GTT memory (cross-process
  pixel leak) and/or faults (DoS).
* SKL sprites (intel_sprite.c:1334 → skl_check_main_surface
  intel_display.c:3025): width capped at max_width but `x1` never checked
  against fb bounds / negativity — bounded OOB remains.
* g4x sprites (intel_sprite.c:1138): width_bytes<=4096 check (1095-1113)
  partially contains; 1:1 early-return path (1090) skips it.
* Primary planes (can_position=false) and the cursor path
  (intel_display.c:9826 rejects panned offsets) are contained.

The QEMU guest has no Intel display hardware, so the final scanout-leak pixel
capture could not be executed; the corruption primitive itself was executed in
the running kernel. Impact ceiling: OOB display-engine read (info leak of
other processes' GPU buffers onto the screen) + display-engine fault DoS,
reachable by an unprivileged local user holding DRM master.

## Fix validation

`fix.diff` (one line): `#define DIV_ROUND_DOWN_ULL(x, n) ((unsigned long long)(x) / (n))`.
Applied inside the guest's /usr/src; drm.ko rebuilt; fresh boot
(`vm.sh reset with-src`, patch, rebuild, first drm load of the boot — the
stock drm.ko unload path stalls on this guest, which is why the patched run
was done on a clean boot); same test module re-run against the patched drm.ko:
**`no divergence` on all three cases, kernel rectangles identical to upstream
Linux semantics** (fix_run.log). Baseline-vs-patched diff is exactly the
finding: corruption present (baseline) / gone (patched).

## Notes

* `EXPORT_SYMBOL` is a no-op in this tree, so `drm_rect_clip_scaled` is a
  plain module global — the test kld resolves it via `MODULE_DEPEND(drm)`.
* Guest was reset (`vm.sh reset with-src`) after both runs; returned clean.
* Unrelated observation: `kldunload drm` on this guest wedges in module
  teardown (pre-existing, not this finding).

## Fix status (batch validation)
Applied with the 36 sibling fix.diffs of this batch in findings/poc/_batch41/all_fixes.patch; single in-guest `make -j6 nativekernel KERNCONF=X86_64_GENERIC` completed RC=0 with zero errors under -Werror (full log: findings/poc/_batch41/fix_build8.log). Behavior A/B intentionally skipped for this Info-tier item.