DF-4573

DragonFly i915 PCI-ID matcher drops subvendor/subdevice criteria: Quanta entry hijacks all 0x016a IvyBridge devices into the headless num_pipes=0 info

Summary

i915_pci_device_id_dfly matches on .device alone, ignoring the subvendor/subdevice fields the Linux PCI core honors; the deliberately-first Quanta entry (0x016a + 152d:8990) first-matches EVERY 0x8086:0x016a IvyBridge GT2-server part, binding the headless num_pipes=0 config - KMS console output lost on otherwise supported hardware. num_pipes=0 is a designed state (no memory corruption). Honor-the-subvendor-fields fix.

Discussion (0)

No comments yet.

Severity: Low
Status: new
Bucket: Base system — drivers
Confidence: certain
Pass: 2 · GLM 5.3 second pass
CVSS 3.1: CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L
CWE: CWE-697
File: sys/dev/drm/i915/i915_pci.c
Lines: 810-341
Area: dev
Discovered: 2026-09-21
Updated: 2026-09-21

Team triage

untriaged

priority: — · owner: —

PoC verification

untested

Status: untested
Reproduced: no
Impact: Display loss (headless num_pipes=0 binding) on all non-Quanta 0x016a IvyBridge GT2-server iGPUs; no memory corruption
Confidence: certain
Tested: 2026-09-21 19:54:51
Attempts: 0
Runtime: —
Code hash: —
Guest: —
Build cmd: —
Run cmd: —

jump to evidence pack ↓

Fix verification

not_testable

Fix status: not_testable
Baseline reproduced: no
Patched reproduced: no
Confidence: certain
Tested: 2026-09-21 19:54:51
Runtime: —
Kernel: per-fix-DF-4573
fix.diff: findings/poc/DF-4573/fix.diff
Runner: df-bsd-reviewer

jump to fix verification ↓

PoC verification

Evidence pack

findings/poc/DF-4573 · 1 files

File	Type	Description	Size
verdict.json	file		952 B	view raw

Fix verification

not_testable

baseline no→ patch + rebuild →patched clean

not_testable: hardware absent from guest

fix in finding markdown

per-fix-DF-4573

Confirmed kernel references

Detail

Exploit chain

[]

Evidence (decisive lines)

The DF matcher compares only .device, dropping subvendor/subdevice; the deliberately-first Quanta entry (0x016a + 152d:8990) first-matches every 0x016a. Honor-subvendor/subdevice fix.

Verdict

not_run: requires physical 0x016a hardware