|
|
command buffer
Every other test in this audit varied command content, but the ring frame itself is
equally host-controlled and carries both an address the processor writes to and the value
it writes there. The command buffer address is range-checked against the trusted region;
this destination never was.
Confirmed on hardware: the processor writes a host-chosen value to a host-chosen address;
a destination inside the trusted region is accepted and the command completes with the
processor healthy, where the equivalent command-buffer address is rejected; and a null
destination completes the command but freezes the heartbeat and wedges the card, a sixth
trigger of the known class needing a power cycle.
Corruption is explicitly not demonstrated. Host reads of the trusted region return all
ones so read-back cannot settle it, and a dense functional test of sixteen thousand
host-chosen values at sixty-four byte granularity across the whole first megabyte, where a
loaded application image lives, leaves that application's behaviour identical. The likely
explanation is that the write is subject to the same hardware protection, so the missing
software check is covered. A first sparse attempt of three hundred values over nineteen
megabytes is recorded as discarded for being too thin to support any conclusion.
This is therefore recorded as a defence-in-depth gap rather than an exercisable primitive,
with fixes to range-check the destination and to reject a null one with a status.
|
