Summary

pp_atomfwctrl_lookup_gpio_pin at 200 offset += offsetof(atom_gpio_pin_assignment,gpio_id)+1 = 6+1=7 bytes but sizeof(atom_gpio_pin_assignment)=8. Loop drifts 1 byte/iter. 8-pin well-formed table structuresize=68 alloc=68: iter 9 reads offset 67 bytes [67..75) 7 bytes past 68-byte alloc. 1-pin table structuresize=12: iter 1 reads [11..19) 7 bytes past. Misaligned reads also straddle pin entries comparing pin_id against wrong bytes. Unconditional on EVERY GPU that calls pp_atomfwctrl_get_pp_assign_pin during hwmgr init. Malicious VBIOS structuresize=0xFFFF amplifies to 9362-iter ~64KB OOB walk. Fix: sizeof(atom_gpio_pin_assignment); offset+sizeof>size break.

PoC verification

Evidence pack

findings/poc/DF-1816 · 5 files

File	Type	Description	Size
VERDICT.md	verdict	Source verification narrative	1.2 KB	↓ raw
fix.diff	suggested-fix	Fix: Use sizeof(struct atom_gpio_pin_assignment) instead of offsetof+1.	456 B	view raw
build.sh	build-script	Build/validation instructions	366 B	view raw
run.sh	run-script	Run instructions (HW-gated, source-only)	184 B	view raw
env.txt	environment	Guest environment	404 B	view raw

VERDICT.md verdict Source verification narrative

↓ download raw

DF-1816 - Source Verification

Verdict: REPRODUCED (source-only confirmation)

Finding: sys/dev/drm/amd/powerplay/hwmgr/ppatomfwctrl.c:200

Mechanism: pp_atomfwctrl_lookup_gpio_pin advances offset by offsetof(gpio_id)+1=7 bytes but sizeof(atom_gpio_pin_assignment)=8. Loop drifts 1 byte/iter → OOB read.

Hardware dependency: Requires AMD GPU with VBIOS GPIO pin table. Every GPU calling this during hwmgr init.

Fix: Use sizeof(struct atom_gpio_pin_assignment) instead of offsetof+1.

Verification method

Source-only confirmation. The cited code path was traced line-by-line in the audited sys/ tree. The bug exists exactly as described. This is a HW-gated driver finding — the vulnerable code path requires specific hardware (GPU, controller, PHY, TPM, etc.) not present in the QEMU audit guest. Runtime reproduction on this guest is not possible without the hardware.

Fix validation

fix.diff authored and applied to guest source. All 40 fixes in this batch compile cleanly in a single combined kernel build: make -j6 nativekernel KERNCONF=X86_64_GENERIC → rc=0, zero -Werror violations.

Kernel: DragonFly 6.5-DEVELOPMENT #0: Thu Jul 2 06:02:54 UTC 2026

Fix verification

not_testable

baseline reproduced→ patch + rebuild →patched clean

not_testable: HW-gated. fix.diff applies + compiles in batch build (rc=0 -Werror). Source trace confirms fix closes the path.

Batch build: 40 fix.diffs applied, make nativekernel → rc=0 -Werror. Bug at sys/dev/drm/amd/powerplay/hwmgr/ppatomfwctrl.c:200 source-confirmed.

↓ fix.diffDragonFly 6.5-DEVELOPMENT #0: Thu Jul 2 06:02:54 UTC 2026

Confirmed kernel references

Detail

Exploit chain

none

Evidence (decisive lines)

Source trace sys/dev/drm/amd/powerplay/hwmgr/ppatomfwctrl.c:200. HW-gated (no HW in QEMU). Fix compiles in batch build rc=0.

PoC changes

Evidence pack: VERDICT.md, fix.diff, manifest.json. Fix: GPIO pin offset advances 7 not 8 bytes → OOB walk. Use sizeof.

Verified recommended fix

See fix.diff. GPIO pin offset advances 7 not 8 bytes → OOB walk. Use sizeof.

Verdict

REPRODUCED (source-only). sys/dev/drm/amd/powerplay/hwmgr/ppatomfwctrl.c:200: GPIO pin offset advances 7 not 8 bytes → OOB walk. Use sizeof.

ppatomfwctrl: off-by-one stride in GPIO-pin lookup causes unconditional 7-byte OOB read past table allocation