{
  "finding_id": "DF-5783",
  "status": "untested",
  "reproduced": false,
  "impact": "none",
  "confidence": "likely",
  "verdict": "intel_legacy_cursor_update() (intel_display.c:13623) passes the LIVE committed crtc state as both old and new to intel_plane_atomic_check_with_state (:13686-13689, the upstream FIXME need a new crtc state? spot), whose check path clears/sets active_planes on that state (intel_atomic_plane.c:129-132). A cursor-off fast-path update that fails afterwards (mutex_lock_interruptible -EINTR at :13693 or intel_plane_pin_fb failure at :13697) bails out without rolling the mutation back: hardware still scans the cursor while crtc->state->active_planes no longer contains PLANE_CURSOR. Upstream fixed this exact bug in v5.0 (c249c5f64336): subsequent modeset-disable then fails to disable the planes correctly, desynchronizing IPS/watermark/plane-disable programming => display-engine underruns/hung pipe (local DoS by a DRM master). Not memory corruption. NOT executed: rig has Bochs VGA only; verified by static path proof + upstream differential.",
  "exploit_chain": "open /dev/dri/card0 -> DRM_IOCTL_SET_MASTER (unprivileged when master slot free) -> cursor ON via DRM_IOCTL_MODE_CURSOR2 -> issue cursor-OFF update raced with a signal so intel_legacy_cursor_update() aborts at the interruptible mutex after the check-phase mutation -> crtc->state->active_planes corrupted vs hardware -> immediately disable the crtc: cursor plane not disabled correctly -> FIFO underruns / dead pipe (DoS) until full re-modeset.",
  "evidence": "VERDICT.md (chain with path:line); fix.diff (backport of upstream c249c5f64336); cursor_active_planes_race.c (trigger sketch); differential in ../DF-5782/differential/ (proves base == upstream v4.20, i.e. fix absent); env.txt (Bochs-only rig).",
  "kernel_refs": [
    "sys/dev/drm/i915/intel_display.c:13623",
    "sys/dev/drm/i915/intel_display.c:13644",
    "sys/dev/drm/i915/intel_display.c:13686",
    "sys/dev/drm/i915/intel_display.c:13693",
    "sys/dev/drm/i915/intel_display.c:13697",
    "sys/dev/drm/i915/intel_atomic_plane.c:110",
    "sys/dev/drm/i915/intel_atomic_plane.c:129",
    "sys/dev/drm/drm_ioctl.c:659",
    "sys/dev/drm/drm_ioctl.c:680"
  ],
  "poc_changes": "n/a \u2014 trigger authored fresh (card discovery + documented master-gated race sequence); could not run against i915 on this rig.",
  "attempts": 0,
  "guest_uname": "DragonFly dfbsd 6.5-DEVELOPMENT #0: Thu Jul 2 06:02:54 UTC 2026 x86_64 (QEMU, Bochs VGA 0x1234:1111, no i915)",
  "runtime_sec": 0,
  "guest_dirty": 0,
  "build_cmd": "cc -O2 -o /tmp/cursor_active_planes_race cursor_active_planes_race.c",
  "run_cmd": "/tmp/cursor_active_planes_race",
  "code_hash": "a952a32b39352e98cdf42f5984cae60938e13167dcd19806938e6aa62d462d4f",
  "notes": "Upstream commit c249c5f64336 (v5.0) is the authoritative fix; its v2 note also documents the concurrent page-flip hazard of touching the live crtc state (swapping it would be a UAF). Same class as the cursor bugs upstream fixes under the untrusted-DRM-master threat model.",
  "recommended_fix": "Backport upstream c249c5f64336: run the cursor fast-path check against a duplicated crtc state and copy only active_planes back on success (fix.diff).",
  "fix_status": "not_tested",
  "fix_baseline_reproduced": false,
  "fix_patched_reproduced": false,
  "fix_verdict": "fix.diff is the faithful backport of upstream c249c5f64336 against the DFly file layout (incl. the duplicate-state + active_planes-only copy-back and the destroy on the error path). Not built/tested: no Intel GPU on the rig; on hardware the upstream igt kms_cursor_legacy / kms_pipe_crc_basic suites exercise both directions.",
  "fix_evidence": "fix.diff; upstream commit c249c5f64336 message (quoted in VERDICT.md); intel_atomic_plane.c:129-132 mutation site."
}