# DF-5782 — i915 fb offset/size u32 overflow (missing upstream 70bbe53c6eac guard)

## What
`intel_fb_offset_to_xy()` in `sys/dev/drm/i915/intel_display.c:2398` lacks the
driver-side "Catch potential overflows early" guard that upstream Linux added
in commit `70bbe53c6eac` ("drm/i915: Make sure fb gtt offsets stay within
32bits", landed v5.0). The DragonFly copy is vendored Linux **v4.20** (proven
by whole-file differential, see `differential/`), which predates that fix.

## Build / Run / Expected (on gen9+ Intel hardware)
```
cc -O2 -o addfb2_offset_overflow addfb2_offset_overflow.c
./addfb2_offset_overflow
```
* vulnerable driver: crafted NV12/CCS ADDFB2 accepted (ioctl returns 0) where
  fixed driver returns `-ERANGE` ("Bad offset 0x... or pitch ... for color plane")
* igt testcases upstream uses: `kms_big_fb/{x,y}-tiled-addfb-size-offset-overflow`

## On this audit rig
QEMU guest has **Bochs VGA only** (pciconf chip 0x1234:1111, no i915 attach,
no drm kld). The trigger therefore cannot execute here; verification is by
**static code path proof + upstream differential** — see `VERDICT.md`.

## Contents
* `addfb2_offset_overflow.c` — the trigger (card discovery + crafted ADDFB2)
* `differential/dfly_vs_v4.20.nonmechanical.txt` — proof the DFly file == upstream v4.20 + KPI shims + 2 backports (no DFly-invented semantics)
* `differential/upstream_4.20_to_v5.1.fb_overflow_hunk.txt` — the exact missing fix hunk
* `fix.diff` — standalone backport of the guard (explicit u64 math, no helper dependency)
* `verdict.json`, `manifest.json`, `env.txt`