# DF-1300 — dc_add_all_planes_for_stream unchecked plane_count stack overflow (dead API)

**Severity:** Medium · **CWE:** CWE-787 (Out-of-bounds Write)
**File:** `sys/dev/drm/amd/display/dc/core/dc_resource.c:1564-1571`

## Build & run (AMD-DC latent bug, DEAD API — no AMD GPU on guest, harness proof)

```
./build.sh   # cc -O0 -Wall -o harness harness.c   (-O0 required)
./run.sh     # ./harness
```

## Expected output (bug present)

```
saved_rbp_canary = 0x00007fffffdfd910  *** CORRUPTED ***
saved_rip_canary = 0x00007fffffdfd914  *** CORRUPTED ***
RESULT: stack buffer overflow CONFIRMED at dc_resource.c:1570-1571
```

## Why -O0

At `-O2` gcc's `-faggressive-loop-optimizations` may silently clamp the loop
to MAX_SURFACES iterations (the OOB writes are UB and get elided). The kernel
builds at `-O2` and MAY compile out the bug — but that is fragile and the
correct fix is the explicit bounds check in `fix.diff`.

## Status

Dead public API (0 in-tree callers). Latent stack-overflow hazard for any
future DC consumer. See `VERDICT.md`.