{
  "finding_id": "DF-4967",
  "status": "untested",
  "reproduced": 0,
  "impact": "none",
  "confidence": "certain",
  "verdict": "Kernel-behavior untestable on this guest (no vendor 0x1002 PCI device, radeon not in the guest kernel config - proof in env.txt). Code-path analysis is certain: radeon_gart_bind/unbind take a 32-bit unsigned offset (radeon_gart.c:241,286) while the GTT heap can span > 4 GiB because radeon_check_arguments (radeon_device.c:1117-1137) accepts the unbounded power-of-two tunable drm.radeon.gart_size and ttm_bo_init_mm sizes TTM_PL_TT from the full gtt_size (radeon_ttm.c:941). bo_mem->start << PAGE_SHIFT then truncates, so BOs at aperture offsets X and X+4GiB alias the same GART entry - cross-process GPU read/write redirection after a root misconfiguration. The truncation arithmetic and the validator acceptance were validated on the guest by gart_math.c (11/11 PASS).",
  "exploit_chain": "root sets drm.radeon.gart_size=8192 (or larger power of two) in /boot/loader.conf -> GTT heap spans 8GiB -> unprivileged user A allocates GTT BO placed below 4GiB, user B above 4GiB -> Bs radeon_gart_bind overwrites As GART PTE and pages[] slot -> GPU translates As aperture addresses to Bs physical page (cross-process GPU data disclosure/corruption). Not reachable on this guest (no radeon hardware).",
  "evidence": "run.log (guest-built gart_math.c, ALL CHECKS PASSED); VERDICT.md (line-by-line trace); env.txt (no 0x1002 PCI device, no drm in kern.conftxt)",
  "kernel_refs": [
    "sys/dev/drm/radeon/radeon_gart.c:241",
    "sys/dev/drm/radeon/radeon_gart.c:286",
    "sys/dev/drm/radeon/radeon_gart.c:299",
    "sys/dev/drm/radeon/radeon_device.c:1137",
    "sys/dev/drm/radeon/radeon_ttm.c:656",
    "sys/dev/drm/radeon/radeon_ttm.c:941"
  ],
  "poc_changes": "no kernel PoC possible (hardware absent); wrote a guest-buildable arithmetic validator reproducing the exact type chain (u64 heap -> unsigned long offset -> unsigned param) with kernel constants",
  "attempts": 1,
  "guest_uname": "DragonFly dfbsd 6.5-DEVELOPMENT DragonFly 6.5-DEVELOPMENT #0: Thu Jul  2 06:02:54 UTC 2026 root@dfbsd:/usr/obj/usr/src/sys/X86_64_GENERIC x86_64",
  "runtime_sec": 30,
  "guest_dirty": 0,
  "build_cmd": "cc -O2 -Wall -o gart_math gart_math.c",
  "run_cmd": "./gart_math",
  "code_hash": "1b20326c6ff1d097b2c7c875c272dee68cbce57993b2ca65b6c562b8f205013d",
  "notes": "Same misconfiguration-assisted precondition class as DF-2012 (amdgpu); distinct defect from known DF-2014 (unbind t/p desync). rs400 gart is guarded (rs400.c:86-93) and unaffected.",
  "recommended_fix": "Widen radeon_gart_bind/unbind offset parameter to uint64_t (and matching radeon.h declarations) so aperture offsets >= 4GiB index the correct GART entries.",
  "fix_status": "not_testable",
  "fix_baseline_reproduced": 0,
  "fix_patched_reproduced": 0,
  "fix_verdict": "Fix not testable: baseline cannot be reproduced on this guest (no radeon GPU). fix.diff widens the API to uint64_t in both functions and the header declaration.",
  "fix_evidence": "fix.diff; absent hardware documented in env.txt"
}