32-bit wraparound family in evergreen CS surface-size validation ((slice+1)*64 wrap → nby=0/layer_size=0; layer_size*mslice u32 product wrap; <<8 base-offset truncation vs 40-bit GPU addresses; htile nbx*nby*4 wrap; streamout <<8 and *4 wrapped before the u64 check) → CS validator bypass → GPU OOB read/write past BO, cross-process GPU memory corruption

DF-3838 — 32-bit wraparound family in the evergreen CS surface-size validator (evergreen_cs_track_validate_{cb,stencil,depth,texture} + htile + streamout tracking) -> validator bypass -> GPU out-of-bounds read/write past the BO (cross-process GPU memory corruption). High.

WHAT TO LOOK AT trigger.c programs CB_COLOR0_SLICE = 0xffffffff with a valid colour format and a draw — on a vulnerable kernel the validator computes nby = ((0xffffffff+1)*64)/nbx == 0 in u32, derives layer_size 0, and accepts ANY (even 1-page) BO for the target, while the GPU honours SLICE_TILE_MAX = 0x3fff and renders 16384 tiles past it. fix.diff u64 math + HW-field masking for every wrap site. verdict.json status inconclusive (no GPU on guest), source-level certain.

SITES (evergreen_cs.c) (slice+1) wrap, raw register stored at :1208/:1416/:1425: :404 cb nby = ((slice + 1) * 64) / surf.nbx :571 stencil (db_depth_slice raw) :668 depth (db_depth_slice raw) -> nby=0 -> layer_size=0 -> offset check at :442/:616/:635/:714/:730 trivially passes. u32 product wraps layer_size * mslice / * depth: :442, :616, :635, :714, :730, :846-848, :906-908 x << 8 computed in u32 (GPU address is 40-bit): :435 (cb_color_bo_offset), :610/:629 (stencil), :708/:724 (depth), :787-788 (texture toffset/moffset) htile roundup(nbx * nby * 4, ...) u32 product: :547 streamout offsets wrapped BEFORE the u64 check at :948-950: :1278 vgt_strmout_bo_offset[tmp] = value << 8 (u32 shift) :1289 vgt_strmout_size[tmp] = value * 4 (u32 mult)

BUILD cc -O2 -o trigger trigger.c RUN ./trigger /dev/dri/card0 EXPECT On real pre-SI radeon HW (evergreen/barts/turks/caicos/cayman), with the CB_COLOR0_BASE reloc pointing at a 1-page BO, the CS is ACCEPTED by the validator (no "cb[%d] bo too small" in dmesg) and the draw writes far past the BO. On the audit QEMU guest: ENOENT.

FAMILY DF-1340 (r600_cs.c, same class, High), DF-3765/DF-3766 (r100.c). Distinct from DF-1245 (pitch div-by-zero in the same expression).

DF-3838 VERDICT — status: inconclusive (hardware-gated), source-level: CERTAIN

Attack chain (all evergreen_cs.c unless noted): 1. Unprivileged DRM-authenticated user submits a non-VM RADEON_CS on an evergreen-family asic -> evergreen_cs_parse() -> evergreen_packet3_check() -> evergreen_cs_handle_reg() records CB/DB/texture state into struct evergreen_cs_track. The SLICE registers are stored RAW: :1208 track->db_depth_slice = radeon_get_ib_value(p, idx); :1416 track->cb_color_slice[tmp] = radeon_get_ib_value(p, idx); (PITCH registers likewise raw, but their div-by-zero sibling is the already-filed DF-1245.) 2. On the next draw (evergreen_cs_track_check at every DRAW_INDEX/DISPATCH/INDIRECT packet), validate_cb/stencil/depth compute surf.nby = ((slice + 1) * 64) / surf.nbx; (:404/:571/:668) with slice a full attacker-chosen u32. slice = 0xffffffff wraps (slice+1) to 0 -> nby = 0 -> layer_size 0 in every mode (linear: :192/:207/:230; 2D tiled: mtile_ps = (mtile_pr * 0)/halign = :271). 3. All BO-size checks then degrade to bo_offset<<8 + 0 > bo_size: :442-443 (cb read/write), :616/:635 (stencil r/w), :714/:730 (depth r/w), :850 (texture), :910 (mip). They pass for any BO >= offset. 4. The GPU, however, masks CB_COLORn_SLICE/DB_DEPTH_SLICE to its hardware field SLICE_TILE_MAX (bits [13:0]) — programming 0xffffffff gives the maximum 0x3fff (16384-tile) surface height, so the color/depth engine and texture sampler address far past the relocated BO — into other processes' GTT/VRAM allocations (no GPUVM isolation on pre-SI non-VM CS). That is cross-process GPU memory corruption: read (texture fetch -> render to readable target) and write (render target / streamout). 5. The same u32-truncation family defeats the remaining bounds: - offset += surf.layer_size * mslice (:442 etc.) — u32u32 wraps; e.g. stencil with db slice 0x01ffffff (no wrap there) gives layer_size 0x80000000; mslice=2 wraps the product to 0. - x << 8 (:435/:610/:629/:708/:724/:787) — computed in u32 while the GPU address register is bits [39:8] of a 40-bit address; user offset 0x01000000 aliases to validator offset 0 but GPU offset 4 GB. - htile roundup(nbxnby4) (:547) — u32 product wraps to a tiny size. - streamout (:1278/:1289) — value << 8 and value * 4 wrap in u32 at store time; the u64 promotion at :948-950 is too late. GPU streamout then writes up to (raw size)4 bytes at (raw base)<<8.

Why not reproduced: audit guest is virtio-only (no /dev/dri, no drm — run.log). The PoC compiles clean (build.log) and documents the exact register programming; full relocation plumbing (GEM bo + reloc chunk) needs libdrm on real hardware. The arithmetic, however, is fully determined at compile time of the validator: ((0xffffffff + 1) * 64) is 0 in u32 — there is no runtime condition that could rescue it.

Severity: High — matches DF-1340 (identical r600 class, filed High/certain, bucket memcorrupt): GPU-side OOB read/write across process boundaries from an unprivileged DRM client. Not CPU-kernel memory corruption on its own, but on pre-SI asics the GTT also hosts kernel-managed buffers (ring/IB pool), so a write primitive can corrupt command streams of other clients.

Fix: fix.diff — mask SLICE registers to the HW field, compute every surface size/offset product in 64-bit, keep streamout raw values and promote at check time. Structurally the same hardening Linux applied to r600 (commit 571043f6ccb6 family). Fix validation: impossible on this guest — fix_status not_applicable.

Fix status (batch validation)

Applied with the 36 sibling fix.diffs of this batch in findings/poc/_batch41/all_fixes.patch; single in-guest make -j6 nativekernel KERNCONF=X86_64_GENERIC completed RC=0 with zero errors under -Werror (full log: findings/poc/_batch41/fix_build8.log). Behavior A/B intentionally skipped for this Info-tier item.