# DF-5187 — VERDICT

**status: untested** · Info/latent — no PoC attempted (no in-tree consumer of
the default path; no DRM device on the audit guest).

Code facts (all verified by reading this tree):

- `drm_mode_mmap_dumb_ioctl` falls back to `drm_gem_dumb_map_offset` when the
  driver does not override (sys/dev/drm/drm_dumb_buffers.c:120-129).
- `drm_gem_dumb_map_offset` returns the vma-manager address
  (sys/dev/drm/drm_gem.c:401); that address space starts at
  `DRM_FILE_PAGE_OFFSET_START` = 0x100000 pages (drm_gem.c:119-123,158-160)
  and carries **no** `DRM_GEM_MAPPING_KEY` bits.
- The cdev mmap path `drm_mmap_single` → `drm_gem_mmap_single` →
  `drm_gem_object_from_offset` (drm_drv.c:1256-1270, drm_gem.c:1063-1080)
  rejects offsets without the KEY bits (ENODEV) and resolves the index through
  the *separate* `mm->idxunr` key space (drm_gem.c:153,576).
- i915's override returns the resolver-compatible form
  `DRM_GEM_MAPPING_OFF(map_list.key) | DRM_GEM_MAPPING_KEY`
  (i915_gem.c:2647-2648) — proof that the two namespaces are distinct and
  only the hash-key form works.
- In-tree users of the default: **none** (`.dumb_map_offset` set by
  amdgpu_drv.c:1322, i915_drv.c:3301, radeon_drv.c:693).

Conclusion: real mis-wiring, currently dead in-tree, actionable one-line fix
(fix.diff).  No runtime verification performed — nothing to run against.

## kernel_refs

- sys/dev/drm/drm_dumb_buffers.c:120-129 (audited-file fallback)
- sys/dev/drm/drm_gem.c:381-406 (default handler)
- sys/dev/drm/drm_gem.c:1063-1080 (resolver requiring KEY|OFF(hash key))
- sys/dev/drm/drm_gem.c:119-160 (two disjoint offset allocators)
- sys/dev/drm/i915/i915_gem.c:2647-2648 (working override form)

## Fix status (batch validation)
Applied with the 36 sibling fix.diffs of this batch in findings/poc/_batch41/all_fixes.patch; single in-guest `make -j6 nativekernel KERNCONF=X86_64_GENERIC` completed RC=0 with zero errors under -Werror (full log: findings/poc/_batch41/fix_build8.log). Behavior A/B intentionally skipped for this Info-tier item.