# DF-4902 — iceland_ih: unvalidated device-DMA'd IH wptr (DF-4843/DF-4854/DF-4887 5th twin)

**File:** `sys/dev/drm/amd/amdgpu/iceland_ih.c` (Topaz/Iceland discrete parts, selected at
`vi.c:1600`)

Iceland is the 5th member of the unvalidated-wptr IH family. All five IH
implementations in the tree (cik, tonga, iceland, cz, vega10) share the same
defect; after this filing every implementation is covered — **none validates wptr alignment**.

## Reproduce
Not runnable on the audit guest: the wptr is DMA'd by the GPU into the host
writeback slot (`adev->wb.wb[adev->irq.ih.wptr_offs]`, iceland_ih.c:192); the
QEMU guest has no AMD GPU (env.txt). Code-certain by inspection —
`diff` of the vulnerable block against the filed twins is empty except for
the function prefix (see VERDICT.md — iceland_ih.c is byte-identical to cz_ih.c in all vulnerable logic).

## The two defects (identical shape to the filed twins)
1. **Permanent interrupt-thread spin** — iceland_ih_get_wptr returns
   `wptr & ptr_mask` only (iceland_ih.c:207). A wptr with phase 1..15 (mod 16)
   can never equal the 16-byte-stepping rptr in the shared walk
   (amdgpu_ih.c:154-157) → the amdgpu ithread re-dispatches the whole ring
   forever, all GPU interrupt delivery dead.
2. **Ring-end OOB read via RB_OVERFLOW recovery** — recovery parks
   `rptr = (wptr + 16) & ptr_mask` (iceland_ih.c:202), importing the misaligned
   phase. For wptr' in [0xFFE4..0xFFEF]|OVERFLOW, rptr lands on
   [0xFFF4..0xFFFF] and the first decode (iceland_ih.c:253-256) reads up to
   12 bytes past the exact-64KiB GTT ring BO (iceland_ih.c:300 /
   amdgpu_ih.c:80-88).

## Artifacts
trigger_sketch.c (hostile-device pattern), fix.diff (alignment normalize +
bounded walk), VERDICT.md, manifest.json, verdict.json, env.txt