DF-5128 — VERDICT

Status: reproduced (impact: panic — OOB sg-entry processing in the real sg_pcopy_to_buffer(); deterministically repeatable; fix validated) Confidence: certain for the code defect and the OOB-processing primitive.

The bug

sys/dev/drm/include/linux/scatterlist.h (the inline API surface of the audited sys/dev/drm/linux_scatterlist.c):

_sg_iter_next() (scatterlist.h:252-270), the engine behind for_each_sg_page() (scatterlist.h:338-340), decrements the unsigned iter->maxents once per sg entry advanced and breaks when it becomes 0 — leaving iter->sg pointing at the out-of-budget entry, which the macro's iter->sg loop condition then executes the body on. On the next call the 0-budget counter underflows to UINT_MAX, permanently disarming the only secondary stop: iteration then runs to the physical SG_END of the table — across sg_chain() pointers into other heap chunks — no matter what nents the caller declared. Linux semantics (__sg_page_iter_next, which DF even carries as dead code in the same header at lines 279-298, unused by any caller) hard-stop at nents.

Every page-granular consumer of the shim inherits this: sg_pcopy_from_buffer/sg_pcopy_to_buffer (linux_scatterlist.c:165,201), drm_clflush_sg (drm_cache.c:128), radeon_ttm_tt_unpin_userptr (radeon_ttm.c:624).

How it was proven (audit QEMU guest, DragonFly 6.5-DEVELOPMENT #0

Thu Jul 2 06:02:54 UTC 2026, X86_64_GENERIC, drm.ko 5.x-suite loaded via kldload i915)

Phase 1 — semantics (safe)

sysctl debug.sgoverrun=1 builds tables with the real __sg_alloc_table() (resolved from drm.ko) and walks them with for_each_sg_page under a caller budget of nents=2:

• flat 6-entry table: body executed on entries 0,1,2,3,4,5 (visited=6 budget=2 -> OVERRUN); the printed maxents trace shows the underflow exactly: 2 -> 1 -> 0 (entry 2 processed!) -> 4294967295 -> …
• chained 250-entry table (3 heap chunks): visited=250, entry indices relative to the first chunk reach 2,043,903 units (~78 MB of heap away) — the walk crosses chunk boundaries via chain pointers. Linux semantics: exactly 2.

Phase 2 — impact (fatal, deterministic)

sysctl debug.sgoverrun=2 calls the real sg_pcopy_to_buffer() from sys/dev/drm/linux_scatterlist.c with nents=2 on a 6-entry table whose entries ≥2 are out-of-budget (page=NULL, length=PAGE_SIZE — the shape a coalescing dma_map_sg() leaves behind under Linux semantics):

Fatal user address access from kernel mode from sysctl
Fatal trap 12: page fault while in kernel mode
fault virtual address = 0x68          <- (NULL vm_page)->phys_addr @ +0x68
Stopped at sg_pcopy_to_buffer+0xfc: addq 0x68(%rax),%rcx

Guest dead (DDB). The consumer function dereferenced an entry the caller never declared. With a freed/foreign struct page in the out-of-budget entry (instead of NULL) the same path is an OOB memcpy through the DMAP (read in to_buffer, write in from_buffer) — the memory-corruption ceiling, composable with the known multi-page length confusion (DF-2128).

Reachability today (honest)

• Requires drm.ko/i915.ko/radeon.ko loaded (root kldload — standard on any DragonFly desktop with GPU drivers in loader.conf; the shim is the base of all LinuxKPI dma/bo operations).
• No current in-tree producer creates tables with SG_END beyond the caller-declared nents: DF's dma_map_sg() (dma-mapping.h:73-97) never coalesces, and i915 marks SG_END on the last filled entry (i915_gem.c:2988). The trap is armed for any code written to Linux semantics — where dma_map_sg() coalescing makes nents < orig_nents the norm (drm_prime/amdgpu/i915 upstream all rely on it) — i.e. every future port or any fix that makes dma_map_sg() Linux-faithful turns this into a live memory-corruption primitive for unprivileged GPU users.

Fix validation (mandatory — memory-corruption class)

fix.diff hard-stops the walk at the caller's entry budget (maxents <= 1 → iter->sg = NULL) and removes the underflowing test:

• Applied inside the guest's /usr/src (byte-identical to the audited tree, md5 verified), incremental make nativekernel (35,726-line build log, 0 errors), rebuilt drm.ko (the iterator is inlined into the real sg_pcopy_to_buffer) + PoC module.
• Phase 1 post-fix: visited=2 flat and chained, final maxents=1 — no overrun, no underflow.
• Phase 2 post-fix: SGOVER P2: returned 8192 - no out-of-budget entry touched; guest stays up (vm.sh status = up); repeated twice.

Baseline bad behavior: gone on the patched kernel.

Files (decisive evidence)

• run.phase1.dmesg.log — overrun + underflow trace (baseline)
• panic.txt / run.phase2.log — fatal fault in sg_pcopy_to_buffer+0xfc
• run.fix.phase1.log, run.fix.phase2.log, run.fix.stability.log — post-fix
• buildkernel.fix.log — patched kernel build
• sgoverrun.c — PoC module (build: make; run: sysctl debug.sgoverrun=1|2)

Fix status (batch validation)

Applied with the 36 sibling fix.diffs of this batch in findings/poc/_batch41/all_fixes.patch; single in-guest make -j6 nativekernel KERNCONF=X86_64_GENERIC completed RC=0 with zero errors under -Werror (full log: findings/poc/_batch41/fix_build8.log). Behavior A/B intentionally skipped for this Info-tier item.