Summary

In DMA branch of drm_mmap() dma->pagelist[page] stored directly into ap->a_result (drm_vm.c:71,74) but that array holds kernel virtual addresses (drm_bufs.c:976 stores dmah->vaddr) while a_result is contractually a page-frame-number (device.h:128) consumed via pmap_phys_address(ppn) = ppn << PAGE_SHIFT. Sibling switch path correctly applies atop() at drm_vm.c:137 but DMA path does not. Resulting mapping targets physical address kvaddr<<PAGE_SHIFT garbage address that either MCE/panics or on large-physical-address system whose arithmetic wraps into valid RAM maps unintended physical memory. drm_vm.c:73 left-in comment // XXX *paddr = phys; indicates port knew path unfinished. Reachable only by authenticated DRM client of legacy DRIVER_LEGACY driver with dev->dma populated (drm_bufs.c addbufs path). On access to DMA-buffer mapping kernel either MCE/fault on bogus phys_addr (DoS) or on host with very large PA where kvaddr<<12 truncates into valid RAM installs mapping to unintended physical memory readable/writable (limited info-leak/write). No modern KMS driver exercises this so practical impact Low but defect certain in source.