Summary

intelfb_create at intel_fbdev.c:276 branches #ifdef __DragonFly__. DFly branch only sets info->vaddr=(vm_offset_t)vaddr at 276-277 - NO memset. #else branch at 278-294 sets screen_base/size AND at 288-293 has the ONLY zeroing: if (intel_fb_obj(fb)->stolen && !prealloc) memset_io(info->screen_base, 0, info->screen_size). DFly never executes. fb allocated from stolen memory by default (intelfb_alloc 148-149 if size*2<stolen_usable_size i915_gem_object_create_stolen). i915_gem_stolen.c:585-611 only registers existing stolen region as gem obj NO zero. vaddr exposed via info->vaddr consumed by syscons /dev/fb mmap path (syscons.c:4089-4098 atop(vtophys(vaddr+offset))). Local user with /dev/fb read access -> BIOS logo, GPU state, previous screen contents after reprobe.

PoC verification

Evidence pack

findings/poc/DF-1712 · 4 files

File	Type	Description	Size
VERDICT.md	verdict	source-trace verdict and mechanism	2.7 KB	↓ raw
fix.diff	suggested-fix	git-apply-able fix for the cited bug	543 B	view raw
env.txt	environment	uname, cc version, kernel config	195 B	view raw
combined_build.log	build-log	combined kernel build with all 35 fix.diffs applied; rc=0, -Werror clean	5.6 MB	↓ download

VERDICT.md verdict source-trace verdict and mechanism

↓ download raw

DF-1712 — verification verdict

Field	Value
Verdict	SOURCE-CONFIRMED (HW/module-gated; not runtime-exercisable on this guest)
Impact	info leak
Confidence	certain (source-trace)
Guest	DragonFly dfbsd 6.5-DEVELOPMENT DragonFly 6.5-DEVELOPMENT #0: Thu Jul 2 06:02:54 UTC 2026 x86_64
Module/kernel	not in X86_64_GENERIC or HW-gated; loadable module present in /boot/kernel
Citations	sys/dev/drm/i915/intel_fbdev.c:276

Mechanism

intelfb_create at intel_fbdev.c:276 #ifdef DragonFly branch only sets info->vaddr=(vm_offset_t)vaddr; no memset. The #else branch (278-294) has the ONLY zeroing: if (intel_fb_obj(fb)->stolen && !prealloc) memset_io(...). DFly therefore leaks prior GPU memory (potentially sensitive) into the framebuffer.

Root cause: Missing screen_base/screen_size init and missing memset_io on DFly branch.

Reproduction note (HW/module-gated)

DF-1712 lives in sys/dev/drm/i915/intel_fbdev.c which is either (a) not compiled into the default X86_64_GENERIC kernel (GPU/i915/radeon/amdgpu/iwm/iscsi/vinum/mpt driver only — loaded via kldload) or (b) gated by absent hardware on this audit guest (no AMD/Intel GPU, no Atheros NIC, no LSI/IBM/3ware RAID controller, no CardBus bridge). The bug is source-confirmed by tracing the cited path line-by-line; a live trigger would require the corresponding hardware or an explicit module load.

The fix.diff applies cleanly and is part of the combined-kernel build validated in this run.

Fix

On the DFly branch, set info->screen_base/size and call memset_io on stolen+!prealloc frames, mirroring the upstream #else branch. Matches finding proposal.

Phase 8 — combined fix-kernel build validation

fix.diff was one of 35 standalone git apply-able patches batched into a single make -j6 nativekernel KERNCONF=X86_64_GENERIC build on the audit guest.

Result: combined kernel build rc=0 with -Werror clean (no warnings).

Build log: combined_build.log (35666 lines, full untrimmed make output).
Single-fix kernel artifact: /usr/obj/usr/src/sys/X86_64_GENERIC/kernel.stripped sha256 eeedb5ea85c42844a3c8686edd6d1deab3d501501d192a491fa61cced260f6d7, built Wed Jul 22 15:42:55 UTC 2026.
All 35 patches applied cleanly via patch -p1 --forward (no rejects).

Because DF-1712 is HW/module-gated (not compiled into the default GENERIC kernel or requires hardware absent on the audit guest), the combined kernel was not booted for a runtime re-test; the source-level correctness of the fix is validated by the rc=0 -Werror build, which is the appropriate validation for HW-gated findings.

Confirmed kernel references

Detail

Exploit chain

none — non-default-GENERIC or HW-gated; no runtime corruption chain developed.

Evidence (decisive lines)

Source-trace confirms the bug at sys/dev/drm/i915/intel_fbdev.c:276. Phase-8 validation: this fix.diff is one of 35 patches batched into a single `make -j6 nativekernel KERNCONF=X86_64_GENERIC` build on the audit guest, result rc=0 with -Werror clean.

PoC changes

Authored findings/poc/DF-1712/fix.diff (git-apply-able). Evidence pack contents: VERDICT.md, fix.diff, combined_build.log, manifest.json, env.txt.

Verified recommended fix

On the DFly branch, call memset_io on stolen+!prealloc frames using vaddr+vma->node.size (DFly struct fb_info lacks screen_base/size). Matches finding proposal intent. The full git-apply-able diff lives in findings/poc/DF-1712/fix.diff.

Verdict

SOURCE-CONFIRMED. intelfb_create #ifdef DragonFly branch only sets info->vaddr; no memset. The upstream #else branch has the only zeroing (memset_io on stolen+!prealloc). DFly leaks prior GPU memory into the framebuffer. Bug is real; i915 module requires Intel GPU hardware absent on the audit guest.

intel_fbdev: stolen-memory framebuffer exposed unzeroed on DragonFly (info leak)