# DF-4974 — radeon cursor BO size not validated (display-engine VRAM OOB read)

## Build

    ./build.sh        # cc -Wall -Wextra -o cursor_oob cursor_oob.c

## Run

    ./run.sh          # on a machine WITH a radeon KMS card, as the seat owner:
                      # open /dev/dri/card0, DRM_IOCTL_MODE_CURSOR2 with a
                      # 1-page VRAM GEM bo, width=64 height=64
    # Expected on real HW: cursor renders 16 KiB of pixels (12 KiB read past
    # the BO end) — adjacent VRAM appears as garbage cursor pixels.
    # On this audit guest (no GPU): exit=1, "No such file or directory".

## Files

- cursor_oob.c   — trigger (device probe + raw ioctl)
- build.sh / run.sh, build.log / run.log
- VERDICT.md     — full narrative + killed candidates
- fix.diff       — proposed upstream fix (never applied to sys/)
- manifest.json / verdict.json