{
  "finding_id": "DF-5581",
  "status": "not_reproduced",
  "verdict": "Root cause is code-certain: intel_graphics_stolen() runs at init386 (machdep.c:2760) and computes the Intel stolen range from firmware-programmed config registers, but its stated purpose - reserving that range - is compiled out (pci_early_quirks.c:308-310; phys_avail_reserve exists nowhere in the tree, live-proven by full-/usr/src grep on the guest). drm/i915 then blindly adopts the values as a GPU-exclusive range (i915_module.c:18-30, i915_gem_stolen.c:414-417) and its only overlap guard, devm_request_mem_region, is a DragonFly stub that manages a rman scoped to the requested region itself and can never detect a conflict (i915_gem_stolen.c:85-102). On buggy-BIOS Intel platforms (firmware failed to hide stolen memory from the OS map) the kernel page allocator and the GPU stolen allocator own the same physical pages, so GPU objects silently corrupt live kernel memory. Not reproduced on the QEMU rig because QEMU has no Intel iGPU device model: 0:2:0 is Bochs VGA 1234:1111, fails the vendor gate at pci_early_quirks.c:288, sysctls stay 0, i915 not loaded. No unprivileged-local software trigger exists (inputs are firmware-owned config registers).",
  "reproduced": false,
  "impact": "none",
  "confidence": "certain",
  "exploit_chain": "",
  "evidence": "findings/poc/DF-5581/run.log (unpriv sysctl read of both globals as uid=1001; pciconf showing 0:2:0 = class 0x0300 chip 0x11111234 so the vendor gate rejects it on this rig; full-tree grep: phys_avail_reserve appears ONLY as the comment at pci_early_quirks.c:309; i915 not loaded) + VERDICT.md chain with the no-op devm_request_mem_region stub at i915_gem_stolen.c:85-102 and the trust sink at i915_gem_stolen.c:414-417",
  "kernel_refs": [
    "sys/bus/pci/x86_64/pci_early_quirks.c:264",
    "sys/bus/pci/x86_64/pci_early_quirks.c:303",
    "sys/bus/pci/x86_64/pci_early_quirks.c:308",
    "sys/platform/pc64/x86_64/machdep.c:2760",
    "sys/dev/drm/i915/i915_module.c:18",
    "sys/dev/drm/i915/i915_gem_stolen.c:85",
    "sys/dev/drm/i915/i915_gem_stolen.c:414"
  ],
  "poc_changes": "no seeded PoC existed; authored probe.sh (guest verification probes) from scratch - the findings trigger class is firmware/hardware, so evidence = boot-rig probes + line-accurate code reading",
  "attempts": 3,
  "guest_uname": "DragonFly dfbsd 6.5-DEVELOPMENT DragonFly 6.5-DEVELOPMENT #0: Thu Jul  2 06:02:54 UTC 2026 root@dfbsd:/usr/obj/usr/src/sys/X86_64_GENERIC x86_64",
  "runtime_sec": 120,
  "guest_dirty": 0,
  "build_cmd": "n/a",
  "run_cmd": "dfbsd-qemu/vm.sh run_user id; sysctl hw.intel_graphics_stolen_base hw.intel_graphics_stolen_size; dfbsd-qemu/vm.sh run_root pciconf -l | grep pci0:0:2:0; grep -rn phys_avail_reserve /usr/src/sys/ --include=*.c --include=*.h; kldstat | grep i915",
  "code_hash": "d5d56901940a30719f4d45ff24a3254ce22f223bfeb1f08befcdcc8269d41eba",
  "notes": "Hard blocker for runtime reproduction: QEMU provides no Intel VGA device model (candidates: VGA=1234:1111, vmware-svga=15ad:0405, virtio-gpu=1af4:1050), so 0:2:0 can never match the intel_ids table without patching QEMU itself. Secondary observation folded into negative notes (not filed): hw.intel_graphics_stolen_base/_size are world-readable sysctls exposing a firmware-programmed physical address - Info-grade at most, inert (0) without Intel GPU. fix.diff verified to git-apply cleanly from repo root (git apply --check) against the read-only sys/ tree; not applied. Guest left clean (read-only probes only), no reset needed.",
  "recommended_fix": "Implement the phys_avail reservation KPI at init386 and reserve the stolen range; until then stop advertising the unreserved range to drm/i915 (fix.diff: zero-size intel_graphics_stolen_res, activating i915_gem_init_stolens zero-size fallback)",
  "fix_status": "not_testable",
  "fix_baseline_reproduced": 0,
  "fix_patched_reproduced": 0,
  "fix_verdict": "Baseline harmful behavior cannot be reproduced on this rig (no Intel iGPU), so a baseline-vs-patched comparison is impossible here. fix.diff is a minimal consumer gate whose semantics were verified by code: DEFINE_RES_MEM(0,0) gives end=-1 hence resource_size()==0 (sys/dev/drm/include/linux/pci.h:621-637), and i915_gem_init_stolen returns early (stolen disabled) on zero size (i915_gem_stolen.c:414-415) - the same fallback Linux uses under DMAR/vGPU. diff git-applies cleanly from repo root; sys/ untouched.",
  "fix_evidence": "findings/poc/DF-5581/fix.diff (git apply --check OK from repo root); sys/dev/drm/include/linux/pci.h:626-637 (DEFINE_RES_MEM/resource_size); sys/dev/drm/i915/i915_gem_stolen.c:414-415 (zero-size fallback)"
}