DF-5159 — build/run

No PoC program exists: the affected functions (bw_int_to_fixed_nonconst, bw_frc_to_fixed, bw_mul) are internal helpers of the AMD DC display bandwidth calculator compiled into the drm amdgpu module. The audit guest has no AMD DC GPU (virtio/QXL VGA, chip=0x11111234) and no drm module loaded, so there is no runtime entry point (see env.txt). The defect — WARN-only range guards with silent u64/int64 wrap — is established by reading the code against the ASSERT definition in os_types.h:76.

• Expected on matching hardware (AMD DCE GPU, mode set with pathological timings): dmesg WARN_ON splats from bw_fixed.c plus mis-programmed watermarks; no panic, no memory corruption.
• Artifacts: VERDICT.md (full narrative + path:line), env.txt, verdict.json.
• No fix.diff: behavior-changing DML arithmetic needs upstream validation (see VERDICT.md); recommended_fix carries the one-line direction.

DF-5159 — bw_fixed.c range guards are ASSERT()=WARN_ON only: silent 64-bit wrap in release builds

File: sys/dev/drm/amd/display/dc/calcs/bw_fixed.c (pass 2, GLM 5.3)

What

Every range/overflow guard in this translation unit is ASSERT(expr), which in this tree expands to WARN_ON(!(expr)) (sys/dev/drm/amd/display/dc/os_types.h:76; only CONFIG_DEBUG_KERNEL_DC builds upgrade it to ASSERT_CRITICAL). In a normal release kernel, WARN_ON logs a splat and execution continues with the wrapped value — the guards protect nothing:

• bw_int_to_fixed_nonconst (bw_fixed.c:49-55): res.value = value << 24 with |value| >= 2^39 (BW_FIXED_MAX_I32, bw_fixed.h:40) shifts bits out of the int64 — silent wrap (and signed-shift UB for negatives).
• bw_frc_to_fixed (bw_fixed.c:57-110):
• abs_i64(INT64_MIN) (bw_fixed.c:41-47): -arg overflows int64 → UB / wraps back to 0x8000000000000000.
• The 24-iteration long-division loop res_value <<= 1 (bw_fixed.c:86) wraps mod 2^64 once the accumulated quotient exceeds 64 bits (integer part assert at bw_fixed.c:76 is WARN-only).
• res.value = -res.value (bw_fixed.c:108) on an already-wrapped MIN.
• bw_mul (bw_fixed.c:143-191): res.value = arg1_int * arg2_int (bw_fixed.c:161) with integer parts up to 2^39-1 each produces up to ~2^78 — unconditional u64 wrap before the first assert (bw_fixed.c:163) even evaluates; the three subsequent summand asserts (169/175/184) are WARN-only.

Consequence: corrupted fixed-point values propagate into the DCE bandwidth calculations (watermarks, latency hiding) and are programmed into display hardware registers — wrong display configuration, WARN splats, potential underflow/GPU-hang behavior. No kernel memory unsafety is possible: the file performs pure arithmetic (no pointers, arrays, copies), so OOB/UAF/leak classes are structurally absent; the ceiling is wrong-value propagation.

This is distinct from the known DF-2155 (unguarded div0 panics in bw_frc_to_fixed/bw_floor2/bw_ceil2, lines 69-132), which is NOT re-reported.

Reachability

Inputs derive from validated display-mode timings, ATOM-BIOS tables and DML constants — not directly from unprivileged memory. No caller on the audit guest: the box has a virtio/QXL VGA device (0x1234:1111), no AMD DC GPU, and no drm modules loaded (env.txt). Severity Info (hardening), CWE-190.

Fix direction (not shipped as a diff)

Convert the asserts into saturating clamps (return ±BW_FIXED_MAX_I32-shaped values) or use full 64x64→128 multiplication and range-check before truncating; upstream amdgpu carries the same WARN-only pattern, so semantics need an upstream decision. fix.diff intentionally omitted: changing DML arithmetic semantics with no hardware to validate against would be riskier than the defect.

Fix status (batch validation)

Applied with the 36 sibling fix.diffs of this batch in findings/poc/_batch41/all_fixes.patch; single in-guest make -j6 nativekernel KERNCONF=X86_64_GENERIC completed RC=0 with zero errors under -Werror (full log: findings/poc/_batch41/fix_build8.log). Behavior A/B intentionally skipped for this Info-tier item.

(No fix.diff for this item: documented recommendation only - see Fix above.)