Summary

size = count * PAGE_SIZE (line 55) multiplies unsigned int count by int PAGE_SIZE (1<<PAGE_SHIFT=4096). Product computed in 32-bit unsigned then zero-extended into size_t arg of kmem_alloc_nofault. When count >= 0x100000 (1M pages=4GiB) count*PAGE_SIZE wraps to small value (count=0x100000 gives size=0 count=0x100001 gives size=0x1000). kmem_alloc_nofault reserves only size bytes VA but line 62 stores unwrapped count into vmp->npages and line 63 pmap_qenter(off pages count) maps FULL count pages into PTEs starting at off -- mapping attacker-influenced physical pages far beyond allocated VA window and reading pages array OOB if caller array shorter than count. Mismatch between reserved VA and PTEs written corrupts adjacent kernel map entries and/or OOB read on pages caller array. Trigger: local user creates >=4GiB GEM object (DRM_IOCTL_I915_GEM_CREATE huge size permitted up to available memory) i915_gem_object_map -> vmap(pages n_pages...) with n_pages >= 0x100000. Resulting VA/PTE mismatch corrupts kernel page tables or triggers OOB read on pages array.