{ "finding_id": "DF-5170", "status": "untested", "reproduced": false, "impact": "none", "confidence": "certain", "verdict": "evergreen_copy_dma() discards the return values of radeon_sync_resv() (evergreen_dma.c:130) and radeon_sync_rings() (evergreen_dma.c:131) \u2014 the Evergreen/Cayman twin of DF-4871 (r600_dma.c:466-467) and DF-5089 (si_dma.c:255-256), and the exact site DF-5089s notes flagged as unfiled. radeon_sync_rings() fails with -EINVAL when a source ring was disabled (radeon_sync.c:153-156, reachable after a failed ib test / GPU reset) and on semaphore-create/ring-alloc/interrupted-manual-wait errors (:158-193); radeon_sync_resv() propagates interrupted dma_fence_wait() on foreign resv fences (radeon_sync.c:106,119) \u2014 currently called while already holding rdev->ring_lock (taken at evergreen_dma.c:123), so that sleep also serializes every ring. On failure the copy packets are still emitted and committed (evergreen_dma.c:133-145, :154), so the DMA copy runs unordered w.r.t. a pending write on the same bo \u2014 silent GPU-side corruption of the migrated bos contents under a healthy fence (the fence at :147 only orders the copy itself). The checked-and-unwind pattern exists in the sibling caller radeon_ib_schedule() for the same call (radeon_ib.c:149-154). Runtime verification is hardware-gated (needs real Evergreen/Cayman hardware in a degraded state; guest is QEMU std-VGA chip=0x11111234, 0 drm modules, no /dev/dri \u2014 env.txt/run.log); hardware-gated Low, per contract PoC-skippable, recorded untested (persist enum has no not_testable/skipped). Impact ceiling: unprivileged-triggerable bo content corruption on degraded hardware (I:L); no kernel memory corruption.", "exploit_chain": "", "evidence": "findings/poc/DF-5170/VERDICT.md (trace: radeon_ttm.c radeon_move_bl -> evergreen_dma.c:121-154 -> radeon_sync.c:89-199 failure modes -> unchecked commit at :154; contrast radeon_ib.c:135,149-154; plus the full pass-2 negative-result table for the rest of evergreen_dma.c incl. ptr_mask-bounded ring writes radeon.h:2708-2718 and the exact 20-bit DMA_PACKET count field evergreend.h:1416-1418); env.txt + run.log (hardware gate probe, this run); fix.diff (git-apply-verified against sys/, mirrors accepted DF-4871 / DF-5089 fix shape)", "kernel_refs": [ "sys/dev/drm/radeon/evergreen_dma.c:130", "sys/dev/drm/radeon/evergreen_dma.c:131", "sys/dev/drm/radeon/evergreen_dma.c:154", "sys/dev/drm/radeon/radeon_sync.c:106", "sys/dev/drm/radeon/radeon_sync.c:153", "sys/dev/drm/radeon/radeon_sync.c:165", "sys/dev/drm/radeon/radeon_sync.c:172", "sys/dev/drm/radeon/radeon_ib.c:135", "sys/dev/drm/radeon/radeon_ib.c:149", "sys/dev/drm/radeon/radeon.h:628", "sys/dev/drm/radeon/radeon.h:2708", "sys/dev/drm/radeon/evergreend.h:1416", "sys/dev/drm/radeon/radeon_asic.c:1373" ], "poc_changes": "n/a \u2014 no PoC seed; no deterministic userland trigger without Evergreen/Cayman-class hardware in a degraded state", "attempts": 1, "guest_uname": "DragonFly dfbsd 6.5-DEVELOPMENT DragonFly 6.5-DEVELOPMENT #0: Thu Jul 2 06:02:54 UTC 2026 root@dfbsd:/usr/obj/usr/src/sys/X86_64_GENERIC x86_64", "runtime_sec": 15, "guest_dirty": 0, "build_cmd": "", "run_cmd": "dfbsd-qemu/vm.sh run_root uname -a; pciconf -l | grep -i \"vga\\|display\"; kldstat | grep -ci \"radeon\\|drm\"; ls /dev/dri (env probe \u2014 run.log/env.txt)", "code_hash": "", "notes": "Twin filed per the routed lead from si_dmas pass-2 audit (DF-5089 notes: evergreen_dma.c:130-131). Family status after this filing: r600 (DF-4870/4871), si (DF-5089/DF-2091), evergreen (DF-2167/DF-5170) done; remaining sibling site flagged by DF-5089: cik.c:3695-3696 (CIK SDMA copy). Pass-2 negatives with weight: DMA_PACKET count field 20 bits == 0xFFFFF clamp (evergreend.h:1416-1418); radeon_ring_write ptr_mask-bounded, no OOB possible on reservation shortfall (radeon.h:2708-2718) \u2014 the unreserved semaphore-wait dwords (radeon_sync.c:186-187) vs the +11 slack (ib_schedule reserves RADEON_NUM_SYNCS*8, radeon_ib.c:135, but evergreen_copy_dma does not) is bounded command-corruption/DRM_ERROR spam only; ib emit <=14 dwords vs 64+NSYNCS*8 reserved (radeon_ib.c:135); ib->length_dw SA-pool-bounded << 2^20 so (length_dw<<12) cannot alias field bits; u64 offset increments <=0x3FFFFC, no u32 wrap; num_loops<=1025 -> ndw<=5136, ring_alloc rejects ndw>ring_size/4 (radeon_ring.c:112-113); wb next_rptr math self-consistent (:71-88); lockup checker read-only; no fill/linear/broadcast op in this file. DF-2167 (>=4GB truncation, :121) known and not re-reported.", "recommended_fix": "Check radeon_sync_resv()/radeon_sync_rings() returns in evergreen_copy_dma() and unwind (unlock_undo + sync_free + ERR_PTR) on failure, moving sync_resv before radeon_ring_lock() \u2014 mirror of the accepted DF-4871 fix", "fix_status": "not_testable", "fix_baseline_reproduced": 0, "fix_patched_reproduced": 0, "fix_verdict": "fix.diff authored from line-accurate source reading and verified to apply cleanly against sys/dev/drm/radeon/evergreen_dma.c (git apply --check, sys/ untouched); mirrors the accepted DF-4871 fix shape and the checked sibling (radeon_ib.c:149-154). Kernel fix-build validation impossible on this guest \u2014 no Evergreen/Cayman hardware to drive the DMA migration path.", "fix_evidence": "findings/poc/DF-5170/fix.diff" }