DF-5008 / run.log
VRAM_OOB: loaded. Attacker model: GEM_CREATE alignment=3MB (non-pow2) size=3MB domains=VRAM, amdgpu_vram_page_split=512 (default) VRAM_OOB: sizeof(struct drm_mm_node)=184 (compiled from the real kernel header) VRAM_OOB: === S1 kernel loop, shadow observation === VRAM_OOB: kvmalloc_array(1, 184) shadow=8 nodes, array bytes=184, observation zone starts at byte 184 VRAM_OOB: pages_per_node=768 num_nodes=1 pow2=0 VRAM_OOB: [!!] 1 node-struct(s) written past the 1-element allocation; nodes[1]: start=768 size=256 allocated=1 color=0 mm=0xfffff8011845f668 hole_size=1047552 VRAM_OOB: S1 kernel loop, shadow observation: OOB WRITE CONFIRMED by real drm_mm VRAM_OOB: === S2 groomed (exact 1-element array among sprayed neighbors) === VRAM_OOB: pages_per_node=768 num_nodes=1 pow2=0 VRAM_OOB: [!!] neighbor 17 word 0: 0000000000000000 != magic (CLOBBERED) VRAM_OOB: [!!] neighbor 17 word 1: fffff8008da72040 != magic (CLOBBERED) VRAM_OOB: [!!] neighbor 17 word 2: aa55aa5500000001 != magic (CLOBBERED) VRAM_OOB: [!!] neighbor 17 word 3: 0000000000000000 != magic (CLOBBERED) VRAM_OOB: [!!] neighbor 17 word 4: 0000000000000000 != magic (CLOBBERED) VRAM_OOB: [!!] neighbor 17 word 5: fffff8008da72060 != magic (CLOBBERED) VRAM_OOB: [!!] neighbor 17 word 6: aa55aa5500000001 != magic (CLOBBERED) VRAM_OOB: [!!] neighbor 17 word 7: 0000000000000000 != magic (CLOBBERED) VRAM_OOB: [!!] neighbor 17 word 8: 0000000000000000 != magic (CLOBBERED) VRAM_OOB: [!!] neighbor 17 word 9: fffff8008da72080 != magic (CLOBBERED) VRAM_OOB: [!!] neighbor 17 word 10: aa55aa5500000001 != magic (CLOBBERED) VRAM_OOB: [!!] neighbor 17 word 11: 00000000000003ff != magic (CLOBBERED) VRAM_OOB: [!!] neighbor 17 word 12: 00000000000ffc00 != magic (CLOBBERED) VRAM_OOB: S2: 13 corrupted words in neighboring kernel heap objects => cross-object heap corruption CONFIRMED VRAM_OOB: === S3 FIXED loop, shadow observation === VRAM_OOB: kvmalloc_array(2, 184) shadow=8 nodes, array bytes=368, observation zone starts at byte 368 VRAM_OOB: FIXED pages_per_node=512 num_nodes=2 pow2=1 VRAM_OOB: S3 FIXED loop, shadow observation: no write beyond num_nodes (clean) VRAM_OOB: SUMMARY S1=1 S2=1 S3=0 (1 = OOB confirmed) [S3 must be 0]