Summary

evergreen_copy_dma() computes size_in_dw as (num_gpu_pages << RADEON_GPU_PAGE_SHIFT) / 4 using u32 arithmetic (evergreen_dma.c:115,121). RADEON_GPU_PAGE_SHIFT=12 so num_gpu_pages >= 0x100000 (4 GiB BO) makes shift wrap modulo 2^32: 0x100001<<12 truncates to 0x1000 /4=0x400=1024 dwords. num_loops=DIV_ROUND_UP(1024,0xfffff)=1 ring_lock reserves only 16 dwords. Loop emits 1 DMA_PACKET_COPY transferring 4096 bytes of ~4 GiB buffer. Function calls radeon_fence_emit+radeon_ring_unlock_commit returns fence so ttm_bo_move_accel_cleanup treats move as complete may free source though ~(4GiB-4KiB) of destination stale/uninitialized. Caller chain: radeon_gem_create_ioctl (DRM_AUTH|DRM_RENDER_ALLOW) takes args->size __u64 creates BO arbitrary size; radeon_move_blit computes num_pages passes as num_gpu_pages. GEM_CREATE no <4GiB cap. Attacker: unprivileged render-node/video-group user ~4GiB available system RAM GTT-domain BO. Impact: GPU memory info disclosure cross-process (stale page contents from freed BOs readable via mmap); silent data corruption; potential DoS if stale data interpreted as GPU page-table/command stream. No kernel heap/stack corruption ring writes correctly bounded by masked wptr. Same pattern as DF-2091 si_dma.c:246.