Summary

agp_sis_set_aperture (agp_sis.c:215): gws=ffs(aperture / 4*1024*1024)-1. Operator precedence: / and * share precedence left-to-right so evaluates as ((aperture/4)*1024)*1024 in u_int32_t NOT aperture/(4*1024*1024). For every valid power-of-2 aperture [4M..256M] intermediate wraps to 0 in u32 so gws=ffs(0)-1=-1. gws<<4 with gws=-1 negative int left-shift UB (C99 6.5.7) in practice writes 0xF0 into WINCTRL low byte setting aperture bits 4-6 to 0b111. agp_sis_get_aperture then reads 4M<<7=512M regardless of requested size. Kernel believes aperture is 512M while PCI BAR resource is BIOS-sized (typically <=256M). Reachable only from attach fallback loop under contigmalloc failure (agp.c:146); root-only (/dev/agpgart 0600); no ioctl AGPIOC_SET_APERTURE. Signed-shift UB latent hazard for UBSan builds. AV:L/AC:H/PR:H, I:L/A:L. Fix: parenthesize aperture/(4*1024*1024).