DF-5114
dragon_saver(): set_video_mode() return value ignored β on failure vid would alias the wrong (32KB text) video window and 64000-byte writes would overrun it
Summary
vid is captured unconditionally after the unchecked mode switch; every write trusts hardcoded 320x200. On failure va_window would describe the text window (32KB) and the 64000-byte writes run ~31KB past into the VGA BIOS shadow (MMIO, not kernel RAM - gpset still bounds pixel coords). Provably unreachable on this tree (same static mode table + flag validated by dragon_init; vga.c the only vidsw provider) - hardening for the generic vidsw contract. Check-and-fail-blank fix.
Discussion (0)
PoC verification
Evidence pack
findings/poc/DF-5114 Β· 1 files| File | Type | Description | Size | |
|---|---|---|---|---|
| verdict.json | file | 1006 B | view raw |
Fix verification
not_testablebaseline noβ patch + rebuild βpatched clean
per-fix-DF-5114
Confirmed kernel references
Detail
Evidence (decisive lines)
source trace in finding markdown
Verified recommended fix
check set_video_mode return; fail the blank (SC_SAVER_FAILED restore path)
Verdict
untested (precondition provably absent on this tree: same mode table+flag validated at init)
No comments yet.