DF-4030 evidence pack

SET_RESOURCE SQ_TEX_VTX_VALID_BUFFER computes (size + offset) in u32 (r600_cs.c:2001-2002); 0xFFFFFF00 + 0x100 wraps to 0 and the BO bound check passes (sim output in run.log); size=value+1 wraps to 0

Build

./build.sh   (cc -O2 -Wall; verified on the DragonFly audit guest — build.log)

Run

./run.sh     (verified on the DragonFly audit guest — run.log; triggers exit 2:
             /dev/dri absent — no radeon GPU on the QEMU guest, see env.txt)

Expected on r600/rv770 hardware

See VERDICT.md.

DF-4030 — r600 SET_RESOURCE VALID_BUFFER: u32 (size + offset) wraparound defeats the BO bound check

File: sys/dev/drm/radeon/r600_cs.c Severity: Medium (GPU vertex fetch up to ~4 GB past the BO; hardware-gated) Cross-ref: DF-3839 (identical defect in evergreen_cs.c, filed pass 2 there; this is the r600 twin, independently reachable via the r600/rv770 parse path).

Root cause (path:line)

2000:           offset = radeon_get_ib_value(p, idx+1+(i*7)+0);   /* u32 */
2001:           size = radeon_get_ib_value(p, idx+1+(i*7)+1) + 1; /* u32; wraps at 0xFFFFFFFF */
2002:           if (p->rdev && (size + offset) > radeon_bo_size(reloc->robj)) {
...
2006:               ib[idx+1+(i*7)+1] = radeon_bo_size(reloc->robj) - offset;

• size + offset is a u32 add (size, offset both u32): 0xFFFFFF00 + 0x100 wraps to 0x00000000 and the bound check passes for any BO (sim output in run.log).
• size = value + 1 itself wraps to 0 for value == 0xFFFFFFFF.
• The forced clamp at :2006 is an underflow when offset > radeon_bo_size() (writes a huge "size" into the executed IB word), a second desync on the same path.

Both the validator and the executed state diverge from the physical BO bound, so the GPU vertex fetcher walks attacker-sized windows past the end of the relocated buffer: OOB read of GPU memory (cross-process disclosure through any subsequent draw that consumes the vertex data).

Upstream status

Same u32 arithmetic in current Linux master (r600_cs.c upstream lines 2005-2011). Unfixed upstream (matches DF-3839's evergreen analysis).

Verification (this pack)

• resource_index_sim.c — prints the wrap: offset=0xffffff00 size=0x00000100 → (size+offset) as u32 = 0x00000000 → bound check PASSES (run.log, executed on the guest).
• r600_cs_poc.c mode resource — slot 5 carries offset=0xFFFFFF00, size-1=0xFF against a 64 MiB BO with the wrap values; builds clean on the guest.
• Runtime hardware-gated (no radeon GPU on the audit guest — env.txt).

Suggested fix

fix.diff: widen the comparison to u64 and reject offset >= bo_size before clamping.

Fix status (batch validation)

Applied with the 36 sibling fix.diffs of this batch in findings/poc/_batch41/all_fixes.patch; single in-guest make -j6 nativekernel KERNCONF=X86_64_GENERIC completed RC=0 with zero errors under -Werror (full log: findings/poc/_batch41/fix_build8.log). Behavior A/B intentionally skipped for this Info-tier item.