DF-5188 — ttm_agp_backend.c: dead, un-compilable, half-ported AGP TTM backend (latent 8x under-allocation OOB + rebind leak if revived)

File: sys/dev/drm/ttm/ttm_agp_backend.c (150 LOC) — pass 2 (GLM 5.3)

Bottom line

The file is not part of any kernel or module build in this tree and cannot compile as-is. It is a Linux TTM source that was partially ported toward the DragonFly native AGP API (function renamed, arguments reordered) and then abandoned — excluded from the build behind a never-defined CONFIG_AGP. If a future change revives it (e.g. by adding the missing LinuxKPI AGP shim, as FreeBSD's drm2 did), the code as written contains:

1. a pages-vs-bytes unit confusion at ttm_agp_backend.c:60 that would under-allocate the backing store by exactly PAGE_SIZE/sizeof(paddr_t) = 8x on x86-64 while the bind loop at :65-72 writes num_pages page pointers into it — a kernel heap OOB write; and
2. an agp_memory leak on every rebind (overwrite at :73 without free; unbind of a bound region returns at :91 without freeing).

Today: zero reachability. No syscall/ioctl/mmap path reaches a single instruction of this file on any DragonFly configuration.

Provenance (why it is dead)

The latent unit confusion (the landmine)

• Native API: void *agp_alloc_memory(device_t dev, int type, vm_size_t bytes) (sys/dev/agp/agpvar.h:100). Bytes. Enforced page-aligned and checked against as_maxmem in agp_generic_alloc_memory (sys/dev/agp/agp.c:456-464); backing store is vm_object_allocate(OBJT_DEFAULT, atop(round_page(size))) (sys/dev/agp/agp.c:472) — i.e. sized from the byte count.
• The half-ported call: agp_alloc_memory(agp_be->bridge, AGP_USER_MEMORY, ttm->num_pages) (ttm_agp_backend.c:60) — page count in a bytes parameter. A num_pages-page BO would request num_pages bytes = num_pages/8 pages of backing on x86-64.
• The consumer: mem->pages[mem->page_count++] = page; for i < ttm->num_pages (ttm_agp_backend.c:65-72). Whoever wires the shim that provides mem->pages from the under-sized object gets an 8x OOB write of attacker-influenced page pointers.
• (Side note: agp_generic_alloc_memory also rejects type != 0 (agp.c:468-471), so AGP_USER_MEMORY = 0x10000 would fail there too — further proof the port was never finished against the generic layer.)

The latent rebind leak

• ttm_agp_unbind on a bound region returns at :91 right after agp_unbind_memory() — it neither frees agp_be->mem nor NULLs it.
• ttm_agp_bind unconditionally overwrites agp_be->mem = mem at :73 (and also leaves it set when agp_bind_memory fails at :78-80).
• Net effect if revived: every unbind→bind cycle (AGP aperture shuffle) or failed bind followed by retry leaks one agp_memory plus its page array — unbounded kernel memory exhaustion from an unprivileged DRM client.

Reproduce / verify absence (what was actually run)

No PoC can exist for a function that is in no binary. Verification performed:

# source level (host)
rg -n "ttm_agp" sys/dev/drm --glob Makefile        # only the commented line
rg -n "CONFIG_AGP" sys/dev/drm/kconfig.h           # no match
find sys -name 'agp.h' -o -name 'agp_backend.h     # no asm/agp.h anywhere
# runtime level (guest)
nm /boot/kernel/drm.ko | grep -ci agp_tt           # -> 0

Recommended disposition

Either delete the file (and the #SRCS+= comment block), or — if AGP support is ever revived — finish the port: add a real LinuxKPI AGP shim, multiply by PAGE_SIZE at :60, free the previous agp_be->mem at :73, and free+NULL in the bound branch of ttm_agp_unbind (:90-91).

DF-5188 — VERDICT

Status: untested (by construction — the target code exists in no kernel artifact). Impact: none today; latent 8x heap OOB write + unbounded agp_memory leak if the backend is ever compiled in. Confidence: certain (on every claim below; each is source- or binary-verifiable in one command).

1. What was audited

sys/dev/drm/ttm/ttm_agp_backend.c — full 150-line read (pass 2, GLM 5.3). Pass 1 recorded no findings for this file (DB check: findings has zero rows for it; the only ttm-family findings are on ttm_bo/ttm_bo_util/ttm_bo_vm/ ttm_page_alloc/ttm_execbuf_util/ttm_bo_manager/ttm_module/ttm_memory — see DF-1445..DF-5138, none on this file).

2. Reachability — refuted at three independent layers

1. Build system: the only Makefile referencing the file is sys/dev/drm/drm/Makefile, where both drm_agpsupport.c and ttm_agp_backend.c sit commented out under the banner # if CONFIG_AGP is set (Makefile:110-112). No other Makefile in the tree mentions it (rg -l ttm_agp sys/ --glob Makefile → that one file).
2. Kconfig: sys/dev/drm/kconfig.h defines 15 CONFIG_ macros, none of them CONFIG_AGP; therefore IS_ENABLED(CONFIG_AGP) expands to 0 (sys/dev/drm/include/linux/kconfig.h:36-39), and the only in-tree callers — sys/dev/drm/radeon/radeon_ttm.c:705,769,824 — compile their ttm_agp_tt_create/populate/unpopulate call sites out entirely.
3. The file cannot compile even if added: #include <asm/agp.h> (ttm_agp_backend.c:43) — no such header exists anywhere under sys/; the only visible struct agp_memory declarations are the native sys/dev/agp/agppriv.h:55-65 (members am_id/am_size/am_type/am_obj/ am_physical/am_offset/am_is_bound — none of the pages, page_count, is_flushed, type, is_bound members used at ttm_agp_backend.c:64-91) and the empty forward declaration in sys/dev/drm/include/linux/agp_backend.h:30-31. Call arities also match nothing: agp_free_memory(mem) (1 arg, :92), agp_bind_memory(mem, off) (2 args, :78), agp_unbind_memory(mem) (1 arg, :91) versus the native prototypes agpvar.h:100-116 (2, 3, and 2 args).

Runtime confirmation (guest, dfbsd-qemu/vm.sh run_root, no mutation): nm /boot/kernel/drm.ko | grep -ci agp_tt → 0. The 22,447,656-byte /boot/kernel/drm.ko built Jun 29 2026 contains no ttm_agp_* symbol; the only agp-matching strings are kld dependency metadata (_mod_metadata_md_drm_on_agp). See runtime_absence.log.

Conclusion: no syscall, ioctl, mmap, net, or mount path can reach any instruction of this file on any DragonFly configuration, current tree.

3. The latent hazards (why this is filed at Info rather than dropped)

The file shows signs of an abandoned half-port to the native API: the alloc call was renamed from Linux's agp_allocate_memory(agp_bridge, num_pages, AGP_USER_MEMORY) to agp_alloc_memory(agp_be->bridge, AGP_USER_MEMORY, ttm->num_pages) — the native name and argument order (agpvar.h:100) but with a page count fed to a vm_size_t bytes parameter:

• agp_generic_alloc_memory (sys/dev/agp/agp.c:456-473) page-align-checks the byte size, charges it against as_maxmem, and sizes the backing vm_object via atop(round_page(size)) (agp.c:472).
• On x86-64, passing num_pages bytes for a num_pages-page BO under-allocates by exactly PAGE_SIZE / 8 = 8x.
• The bind loop then stores num_pages page pointers (ttm_agp_backend.c:65-72). Any future shim that derives mem->pages from the (under-sized) native object turns this into a kernel heap OOB write with attacker-influenced contents (page pointers of an unprivileged-created TTM BO).

Second latent hazard — lifecycle leak: ttm_agp_unbind returns at :91 after agp_unbind_memory() on a bound region without freeing or NULLing agp_be->mem, and ttm_agp_bind overwrites agp_be->mem at :73 without freeing the previous allocation (and leaves it set on the agp_bind_memory failure path :78-80). Revived, every AGP aperture rebind leaks one agp_memory + page array — unbounded kernel memory exhaustion by an unprivileged DRM client.

FreeBSD's drm2 has exactly the LinuxKPI AGP shim this file is missing, so "revive CONFIG_AGP" is a plausible future change that would walk into both landmines unless this is on record.

4. Phase V

Not applicable in the strong sense: the trigger target (compiled code) does not exist in any kernel image; there is nothing to build or run. The verification that was performed is the three-layer reachability refutation above plus the runtime symbol-absence check. Per the orchestrator's status vocabulary this is recorded as untested with impact: latent and attempts: 1 (the nm check). No fix.diff: the fix is deletion or completion of the port, not a one-line patch to live code; the recommended disposition in README.md §"Recommended disposition" covers both.

5. Classes considered and killed (pass-2 depth)

• Populate/pages/counts OOB (:60-72): real as latent unit bug, dead as shipped — this finding.
• Unbind/bind/destroy double-free (:85-106): destroy path (ttm_tt_destroy → unbind-then-destroy, and the :102-103 re-unbind) ends in agp_free_memory on the not-bound member — no double-free even hypothetically; the defect is the leak, covered above.
• ttm_agp_tt_create (:114-134): M_WAITOK NULL-check is dead code, error path frees correctly — nothing.
• ttm_agp_tt_populate/unpopulate (:137-149): thin wrappers into ttm_pool_(un)populate — that surface is already filed (DF-1663, DF-4507); nothing new here.
• Build gating: refuted above (Makefile:110-112, kconfig.h, radeon guards).

Fix status (batch validation)

Applied with the 36 sibling fix.diffs of this batch in findings/poc/_batch41/all_fixes.patch; single in-guest make -j6 nativekernel KERNCONF=X86_64_GENERIC completed RC=0 with zero errors under -Werror (full log: findings/poc/_batch41/fix_build8.log). Behavior A/B intentionally skipped for this Info-tier item.

(No fix.diff for this item: documented recommendation only - see Fix above.)