DF-4891 VERDICT — REPRODUCED (in-kernel primitive), fix validated

Bottom line

DragonFly's DIV_ROUND_DOWN_ULL(x,n) compat shim (sys/dev/drm/include/linux/kernel.h:61) computes (x/n)*n instead of Linux's do_div-truncated x/n. Its sole in-tree user is clip_scaled() (sys/dev/drm/drm_rect.c:64). Consequently every 1:1 or downscaled plane update that gets clipped by drm_rect_clip_scaled() receives a source rectangle whose width/height are (src*(dst-diff)/dst)*dst mod 2^32 — up to ~2^32 units and effectively attacker-chosen — written back into plane_state->src (drm_rect.c:90/98/106/114) after the DRM core already validated the original src against the framebuffer (drm_atomic.c:573-586, drm_plane.c:623-636) and without any later fb-bounds re-validation on the i915 sprite paths.

What was executed (guest, stock kernel)

df4891.ko (MODULE_DEPEND on drm) called the real exported drm_rect_clip_scaled() from the guest's stock drm.ko with three unprivileged-SetPlane geometries (1920x1080 fb, 1:1 and 2:1 planes, left/top and right/bottom CRTC clips):

All three: visible=1 — the plane is accepted; the corrupted src is what the driver would program. See run.log.

Sink trace (code-level; hardware absent on this guest)

drm_atomic_helper_check_plane_state() (drm_atomic_helper.c:790) stores the corrupted src into plane_state->src; callers:

• VLV/CHV sprites: vlv_sprite_check intel_sprite.c:1195 → intel_plane_check_src_coordinates intel_sprite.c:255 (pixel-snap only — Case A/D snap to src_x=32767px) → i9xx_check_plane_surface intel_display.c:3312 (no src bounds check) → intel_compute_aligned_offset intel_display.c:2410 (offset = *y * pitch + *x * cpp, u32 wrap) → DSPSURF/DSPADDR/SPSIZE. Case C programs a 12288px-wide viewport on a 1920px-wide fb: the display engine scans ~4x past the fb row into adjacent GTT memory (cross-process pixel leak) and/or faults (DoS).
• SKL sprites (intel_sprite.c:1334 → skl_check_main_surface intel_display.c:3025): width capped at max_width but x1 never checked against fb bounds / negativity — bounded OOB remains.
• g4x sprites (intel_sprite.c:1138): width_bytes<=4096 check (1095-1113) partially contains; 1:1 early-return path (1090) skips it.
• Primary planes (can_position=false) and the cursor path (intel_display.c:9826 rejects panned offsets) are contained.

The QEMU guest has no Intel display hardware, so the final scanout-leak pixel capture could not be executed; the corruption primitive itself was executed in the running kernel. Impact ceiling: OOB display-engine read (info leak of other processes' GPU buffers onto the screen) + display-engine fault DoS, reachable by an unprivileged local user holding DRM master.

Fix validation

fix.diff (one line): #define DIV_ROUND_DOWN_ULL(x, n) ((unsigned long long)(x) / (n)). Applied inside the guest's /usr/src; drm.ko rebuilt; fresh boot (vm.sh reset with-src, patch, rebuild, first drm load of the boot — the stock drm.ko unload path stalls on this guest, which is why the patched run was done on a clean boot); same test module re-run against the patched drm.ko: no divergence on all three cases, kernel rectangles identical to upstream Linux semantics (fix_run.log). Baseline-vs-patched diff is exactly the finding: corruption present (baseline) / gone (patched).

Notes

• EXPORT_SYMBOL is a no-op in this tree, so drm_rect_clip_scaled is a plain module global — the test kld resolves it via MODULE_DEPEND(drm).
• Guest was reset (vm.sh reset with-src) after both runs; returned clean.
• Unrelated observation: kldunload drm on this guest wedges in module teardown (pre-existing, not this finding).

Fix status (batch validation)

Applied with the 36 sibling fix.diffs of this batch in findings/poc/_batch41/all_fixes.patch; single in-guest make -j6 nativekernel KERNCONF=X86_64_GENERIC completed RC=0 with zero errors under -Werror (full log: findings/poc/_batch41/fix_build8.log). Behavior A/B intentionally skipped for this Info-tier item.