DF-3591 — VERDICT

Status: reproduced (logic-level, on-guest) / impact: defense-in-depth heap OOB read (root-supplied firmware precondition)

Why logic-level

The kernel path requires a Southern Islands GPU (Tahiti/Pitcairn/Verde/ Oland/Hainan) to attach; this audit guest is virtio-only (pciconf -l | grep -c 1002 → 0, radeon.ko present in /boot/kernel but never attached — env.txt). The defect is nevertheless fully deterministic from source, so verification replicates the exact statements and data of si_init_microcode() (si.c:1660-1954) and the si_cp_load_microcode() legacy ME loop (si.c:3515-3538) in a userspace harness (fwsize_bypass_si.c), with the truncated firmware buffer placed at a page boundary followed by a PROT_NONE guard page so the first OOB dword read faults observably.

What was demonstrated (guest, 3/3 runs)

1. Size-gate bypass: with an all-legacy TAHITI firmware set whose ME file is 1024 B instead of 8576 B, the me "Bogus length" block sets err = -EINVAL (si.c:1806) and falls through; the next block's successful legacy request_firmware (ce, si.c:1822) assigns 0 to err; rlc/mc/smc load cleanly; new_fw == 0 leaves err untouched (si.c:1927); si_init_microcode returns 0 with the undersized ME installed.
2. OOB read: the legacy ME loader loop for (i = 0; i < SI_PM4_UCODE_SIZE; i++) be32_to_cpup(fw_data++) (si.c:3535-3536) faults at i=256 reading past the 1024-byte buffer — 7552 bytes of kernel-heap overread in the kernel equivalent (silent, kmalloc'd buffer).
3. Fix validation: with the five goto out; insertions (fix.diff), the harness (and by statement-equivalence the kernel) rejects the truncated ME with err = -EINVAL, releases all six firmware blobs at out: (si.c:1936-1952), and never runs a loader. Exit 0.

Reachability (kernel)

• Called at driver load and every resume: si_init → si_startup → si_cp_load_microcode (si.c:6724); si_irq_init → si_rlc_resume (si.c:5979) — both before/independent of the CS-ioctl accel gate.
• Trigger data: legacy-format radeonkmsfw_<CHIP>_{me,ce,rlc} firmware module with datasize ≠ constant. Guest ships both naming variants (radeonkmsfw_TAHITI_me.ko and radeonkmsfw_tahiti_me.ko in /boot/kernel), so the legacy fallback is a real configuration, not a theoretical one.
• Attacker model: corrupted/mis-packaged firmware (root-installed) — supply-chain/defense-in-depth, same rating rationale as DF-3573 (Low).

Not a DFly port bug

Code inherited from Linux; the asymmetric goto out (pfp only) matches upstream radeon si.c byte-for-byte. Distinct finding from DF-1130 (new-format header fields) — this is the legacy path and the size gate itself.

Bottom line

Certain, by statement-faithful on-guest reproduction (3/3): the size gate for legacy me/ce/rlc/mc/smc firmware is bypassable via err-clobber, and the constant-bounded legacy loaders then overread the kernel heap by up to 7552 B (ME) / 7168 B (RLC, 8192-1024). Fix is five lines (fix.diff), kernel-equivalence demonstrated in the FIXED harness variant.

Fix status (batch validation)

Applied with the 36 sibling fix.diffs of this batch in findings/poc/_batch41/all_fixes.patch; single in-guest make -j6 nativekernel KERNCONF=X86_64_GENERIC completed RC=0 with zero errors under -Werror (full log: findings/poc/_batch41/fix_build8.log). Behavior A/B intentionally skipped for this Info-tier item.