{
  "finding_id": "DF-4968",
  "status": "untested",
  "reproduced": 0,
  "impact": "none",
  "confidence": "certain",
  "verdict": "Kernel behavior untestable on this guest (no radeon PCI device, radeon not in the guest kernel config). Arithmetic certain, validated on the guest by gart_math.c (11/11 PASS): with drm.radeon.gart_size a power-of-two >= 2 TiB, num_gpu_pages*8 (or *4 at >= 4 TiB) wraps table_size to exactly 0 because the validator only accepts powers of two - unlike amdgpu (DF-2012), where non-power-of-two values produced a small-but-usable 2048-byte table. A 0-size table cannot be usefully mapped (radeon_bo_create(0)/pci_alloc_consistent(0) -> zero-page BO/NULL; kmap of 0 pages errors or returns NULL), so gart enable fails closed. Filed Info/hardening: radeon_gart_table_vram_alloc (radeon_gart.c:127) and radeon_gart_table_ram_alloc (:68) never validate table_size against num_gpu_pages, and radeon_gart_init (:345-346) stores gtt_size/PAGE_SIZE into u32 fields without an overflow check - the same missing invariants DF-2012 fixed in amdgpu. Any future relaxation of the power-of-two validator turns this into the DF-2012 OOB write (sinks: radeon_gart.c:305-313 set_page and the :178-179 vram_pin restore loop).",
  "exploit_chain": "",
  "evidence": "run.log (gart_math.c on guest: table_size wrap to 0 at gart=2TiB/4TiB, num_gpu_pages u32 truncation at 16TiB); VERDICT.md (chain + fail-closed reasoning); env.txt (hardware absence)",
  "kernel_refs": ["sys/dev/drm/radeon/radeon_gart.c:345", "sys/dev/drm/radeon/radeon_gart.c:127", "sys/dev/drm/radeon/radeon_gart.c:68", "sys/dev/drm/radeon/radeon_gart.c:178", "sys/dev/drm/radeon/radeon_device.c:1126", "sys/dev/drm/radeon/r600.c:1115", "sys/dev/drm/radeon/r100.c:647"],
  "poc_changes": "arithmetic validator instead of kernel PoC (hardware absent)",
  "attempts": 1,
  "guest_uname": "DragonFly dfbsd 6.5-DEVELOPMENT DragonFly 6.5-DEVELOPMENT #0: Thu Jul  2 06:02:54 UTC 2026 root@dfbsd:/usr/obj/usr/src/sys/X86_64_GENERIC x86_64",
  "runtime_sec": 15,
  "guest_dirty": 0,
  "build_cmd": "cc -O2 -Wall -o gart_math gart_math.c",
  "run_cmd": "./gart_math",
  "code_hash": "1b20326c6ff1d097b2c7c875c272dee68cbce57993b2ca65b6c562b8f205013d",
  "notes": "DF-2012 radeon twin, distinct file; rs400 variant bounded by rs400.c:86-93 switch. Power-of-two validator makes the wrap always land on 0 - fail closed, hence Info.",
  "recommended_fix": "Add a radeon_gart_table_size_ok() invariant check (64-bit multiply/divide) at the top of radeon_gart_table_vram_alloc and radeon_gart_table_ram_alloc, rejecting undersized/wrapped tables.",
  "fix_status": "not_testable",
  "fix_baseline_reproduced": 0,
  "fix_patched_reproduced": 0,
  "fix_verdict": "Fix not testable: baseline cannot be reproduced on this guest (no radeon GPU); fix.diff adds the missing table_size/num_gpu_pages consistency check at both allocation sites.",
  "fix_evidence": "fix.diff; hardware absence documented in env.txt"
}