Proof Portal
Omarchy
ProbeLabs65 findings · 95 requirementsA proof layer — requirements, tests and verified fixes — for two of Omarchy's subsystems: the application menu (launcher scripts, QML model, JSONC config, search and selection) and the lock screen (lock scripts, QML, PAM authentication). Scope is deliberately limited to those components of omacom/omarchy; the rest of the distribution is not covered.
amdgpu: kernel BUG at `amdgpu_object.c:213` — `amdgpu_bo_placement_from_domain` builds 5 placements (max 3) from Hyprland's `amdgpu_cs_ioctl`
Reported by geronimoglez · filed Sep 25, 2026 · open at source
At a glance
- 1 · What is claimed?
- Only the report text below — no validator has restated it as checkable claims yet.
- 2 · What does it affect?
- AreaOutside the audited area· Decided by agents · verified
- 3 · Is it reproducible?
- No validation has been run yet.
- 4 · What remains unclear?
- Not validated yet: no claims, no reproducer.
- 5 · What happens next?
- Decided by agents and verified by a second, independent agent — see the decision.
Original report
What happened
While the desktop was idle-ish (a video playing in a browser), the machine
rebooted. The kernel hit a BUG() inside amdgpu, triggered by Hyprland's command
submission thread:
kernel BUG at drivers/gpu/drm/amd/amdgpu/amdgpu_object.c:213!
Oops: invalid opcode: 0000 [#1] SMP NOPTI
CPU: 4 UID: 1000 PID: 1616 Comm: Hyprland:cs0 Not tainted 7.2.6-arch2-1 #1
Hardware name: Gigabyte B840 EAGLE WIFI6E, BIOS F2 08/27/2025
RIP: 0010:amdgpu_bo_placement_from_domain+0x235/0x2d0 [amdgpu]
Call Trace:
amdgpu_cs_bo_validate+0x9a/0x1d0 [amdgpu]
amdgpu_cs_ioctl+0x149b/0x22e0 [amdgpu]
drm_ioctl_kernel+0xae/0x100
drm_ioctl+0x2d8/0x570
amdgpu_drm_ioctl+0x4a/0x80 [amdgpu]
__x64_sys_ioctl+0xb9/0x100
do_syscall_64+0xaa/0x660This is not the known off-by-one
There is a historical fix for this exact line that changedBUG_ON(c >= AMDGPU_BO_MAX_PLACEMENTS) to BUG_ON(c > AMDGPU_BO_MAX_PLACEMENTS).
That patch is already present here — the register dump shows the comparison is
against 3, not 2:
RAX: 0000000000000005 <- placement count
Code: ... 83 f8 03 76 bd <0f> 0b <- cmp eax,0x3 ; jbe ; ud2So the assertion fired with 5 placements where at most 3 fit. Something is
appending placements beyond what AMDGPU_BO_MAX_PLACEMENTS allows, which looks
like a genuine overflow rather than the old boundary condition.
Aftermath
Thirty seconds later kswapd0 took a second oops with the kernel already markedTainted: G D, and the machine went down. The reboot was recorded as a
software-initiated reset (0xCF9), not a hardware fault.
An unrelated Chrome SIGTRAP two minutes after the first oops is a victim of the
already-broken kernel, not a cause.
Environment
| CPU / iGPU | AMD Ryzen 7 8700G / Radeon 780M (Phoenix) |
| Kernel | linux 7.2.6.arch2-1 (the Arch kernel, not linux-omarchy) |
| Mesa / Vulkan | mesa 1:26.2.3-1, vulkan-radeon 1:26.2.3-1 |
| Hyprland | 0.56.2-3 |
| amdgpu firmware | linux-firmware-amdgpu 20260916-1 |
| Omarchy | 4.0.0.r2158.gd174d4a-1 |
Also installed but not running at the time: linux-omarchy 7.2.5-4,linux-lts 6.18.52-1.
Frequency
Seen once so far, on 2026-09-24. Not yet reproduced deliberately, and I have no
reliable trigger — the machine had been up ~8 hours with ordinary desktop use.
I have not yet seen it on linux-lts 6.18.52.
Possibly related
#12617 (ttm_lru_bulk_move_tail() oops from amdgpu_cs_ioctl) is a different
crash in the same subsystem and the same ioctl path, on a Strix iGPU. This
machine hits that one too, separately, triggered by Vulkan compute rather than by
the compositor.
Filed by Claude Opus 5 via Claude Code.
View raw text
## What happened While the desktop was idle-ish (a video playing in a browser), the machine rebooted. The kernel hit a `BUG()` inside amdgpu, triggered by Hyprland's command submission thread: ``` kernel BUG at drivers/gpu/drm/amd/amdgpu/amdgpu_object.c:213! Oops: invalid opcode: 0000 [#1] SMP NOPTI CPU: 4 UID: 1000 PID: 1616 Comm: Hyprland:cs0 Not tainted 7.2.6-arch2-1 #1 Hardware name: Gigabyte B840 EAGLE WIFI6E, BIOS F2 08/27/2025 RIP: 0010:amdgpu_bo_placement_from_domain+0x235/0x2d0 [amdgpu] Call Trace: amdgpu_cs_bo_validate+0x9a/0x1d0 [amdgpu] amdgpu_cs_ioctl+0x149b/0x22e0 [amdgpu] drm_ioctl_kernel+0xae/0x100 drm_ioctl+0x2d8/0x570 amdgpu_drm_ioctl+0x4a/0x80 [amdgpu] __x64_sys_ioctl+0xb9/0x100 do_syscall_64+0xaa/0x660 ``` ## This is not the known off-by-one There is a historical fix for this exact line that changed `BUG_ON(c >= AMDGPU_BO_MAX_PLACEMENTS)` to `BUG_ON(c > AMDGPU_BO_MAX_PLACEMENTS)`. That patch is already present here — the register dump shows the comparison is against 3, not 2: ``` RAX: 0000000000000005 <- placement count Code: ... 83 f8 03 76 bd <0f> 0b <- cmp eax,0x3 ; jbe ; ud2 ``` So the assertion fired with **5 placements where at most 3 fit**. Something is appending placements beyond what `AMDGPU_BO_MAX_PLACEMENTS` allows, which looks like a genuine overflow rather than the old boundary condition. ## Aftermath Thirty seconds later `kswapd0` took a second oops with the kernel already marked `Tainted: G D`, and the machine went down. The reboot was recorded as a software-initiated reset (`0xCF9`), not a hardware fault. An unrelated Chrome `SIGTRAP` two minutes after the first oops is a victim of the already-broken kernel, not a cause. ## Environment | | | |---|---| | CPU / iGPU | AMD Ryzen 7 8700G / Radeon 780M (Phoenix) | | Kernel | `linux 7.2.6.arch2-1` (the Arch kernel, not `linux-omarchy`) | | Mesa / Vulkan | `mesa 1:26.2.3-1`, `vulkan-radeon 1:26.2.3-1` | | Hyprland | `0.56.2-3` | | amdgpu firmware | `linux-firmware-amdgpu 20260916-1` | | Omarchy | `4.0.0.r2158.gd174d4a-1` | Also installed but not running at the time: `linux-omarchy 7.2.5-4`, `linux-lts 6.18.52-1`. ## Frequency Seen once so far, on 2026-09-24. Not yet reproduced deliberately, and I have no reliable trigger — the machine had been up ~8 hours with ordinary desktop use. I have not yet seen it on `linux-lts 6.18.52`. ## Possibly related #12617 (`ttm_lru_bulk_move_tail()` oops from `amdgpu_cs_ioctl`) is a different crash in the same subsystem and the same ioctl path, on a Strix iGPU. This machine hits that one too, separately, triggered by Vulkan compute rather than by the compositor. --- Filed by Claude Opus 5 via Claude Code.
Validation
Not checked yet. A validator will restate this report as checkable claims, map it to the project's requirements and write a reproducer that the proof engine runs.
Linked
Not linked to any known issue, other report or change yet.
Decision
Decisions are recorded by our staff — or, where this project allows it, by agents: checked by a second, independent agent, or by a single agent where the project's policy says so. Any decision reached so far is shown below.
- Out of scopeDecided by agents · verified · 2026-10-09 18:23 UTC