# DF-5223 — rv770_copy_dma under-reserves DMA-ring space for multi-ring semaphore waits (GPU command-stream corruption)

- **File:** `sys/dev/drm/radeon/rv770_dma.c:59` (Radeon RV770/RV730/RV710/RV740 — HD 4000 series, `radeon_asic.c:2412-2416`)
- **Class:** incorrect buffer-size calculation (CWE-131) → GPU-visible ring-buffer overwrite (un-executed command corruption)
- **Hardware-gated:** requires an R700-class Radeon GPU (DMA copy engine + GFX/UVD rings). NOT reproducible on the QEMU std-VGA audit guest.

## Build & run (inside the DragonFly guest)

```
sh build.sh     # cc -O2 -Wall -o /tmp/sim_accounting sim_accounting.c
sh run.sh       # prints every (S, num_loops) combination that overflows the reservation
```

## Expected output (decisive lines)

```
DEFICIT: S=2 num_loops=8   reserved=48   consumed=64   overflow=16 dwords past reserved window ...
DEFICIT: S=2 num_loops=11  reserved=64   consumed=80   overflow=16 dwords past reserved window ...
... (every num_loops ≡ 8, 11, 14 mod 16; S=0 and S=1 never overflow)
DEFICIT CONFIRMED (static arithmetic; hardware-gated runtime)
exit=1
```

The simulator is a 1:1 arithmetic model of `radeon_ring_alloc`/`radeon_ring_write`/
`radeon_ring_commit` (paths cited in the source header) — it is **not** the kernel
path itself; the kernel path cannot execute without R700 hardware (see VERDICT.md
for the guest proof: no AMD/ATI PCI device, `kldload radeondrm` → module absent).

## Artifacts

- `sim_accounting.c` — the simulator (all kernel semantics cited path:line)
- `build.sh`, `run.sh`, `build.log`, `run.log` — guest build + decisive run
- `env.txt` — guest environment + hardware proof
- `fix.diff` — git-apply-verified reservation fix (never applied to `sys/`)
- `VERDICT.md` — full narrative