# DF-4901 — cz_ih: unvalidated device-DMA'd IH wptr (DF-4843/DF-4854/DF-4887 4th twin)

**File:** `sys/dev/drm/amd/amdgpu/cz_ih.c` (Carrizo/Stoney APUs, selected at
`vi.c:1671` and `vi.c:1692`)

CZ is the 4th member of the unvalidated-wptr IH family. All five IH
implementations in the tree (cik, tonga, iceland, cz, vega10) share the same
defect; after this filing and DF-4902 (iceland) every implementation is
covered — **none validates wptr alignment**.

## Reproduce
Not runnable on the audit guest: the wptr is DMA'd by the GPU into the host
writeback slot (`adev->wb.wb[adev->irq.ih.wptr_offs]`, cz_ih.c:192); the
QEMU guest has no AMD GPU (env.txt). Code-certain by inspection —
`diff` of the vulnerable block against the filed twins is empty except for
the function prefix (see VERDICT.md).

## The two defects (identical shape to the filed twins)
1. **Permanent interrupt-thread spin** — cz_ih_get_wptr returns
   `wptr & ptr_mask` only (cz_ih.c:207). A wptr with phase 1..15 (mod 16)
   can never equal the 16-byte-stepping rptr in the shared walk
   (amdgpu_ih.c:154-157) → the amdgpu ithread re-dispatches the whole ring
   forever, all GPU interrupt delivery dead.
2. **Ring-end OOB read via RB_OVERFLOW recovery** — recovery parks
   `rptr = (wptr + 16) & ptr_mask` (cz_ih.c:202), importing the misaligned
   phase. For wptr' in [0xFFE4..0xFFEF]|OVERFLOW, rptr lands on
   [0xFFF4..0xFFFF] and the first decode (cz_ih.c:253-256) reads up to
   12 bytes past the exact-64KiB GTT ring BO (cz_ih.c:300 /
   amdgpu_ih.c:80-88).

## Artifacts
trigger_sketch.c (hostile-device pattern), fix.diff (alignment normalize +
bounded walk), VERDICT.md, manifest.json, verdict.json, env.txt