# DF-1319 — Unvalidated DisplayPort lane_count → stack overflow (amdgpu)

**Status:** INCONCLUSIVE (real bug; needs AMD GPU + amdgpu, both absent from audit guest)
**Impact:** stack buffer overflow via malicious DP sink (unauthenticated physical-layer)
**Driver:** amdgpu DisplayPort link training — NOT in `X86_64_GENERIC`, not loaded

## Reproduce (hardware-equipped host only)
No userspace PoC can exercise a DP-peripheral attack.  Reproduction
requires an amdgpu host with a malicious DP sink (programmable DP
attacker dongle) that returns `lane_count > 4` in DPCD 0x220 on
automated link-training test.  Hotplug → HPD → stack overflow in
`dpcd_set_lt_pattern_and_lane_settings`.

On the audit guest: amdgpu absent, no AMD GPU, no DP peripheral — nothing
to run.  See `VERDICT.md` for the source trace and `fix.diff` for the
validated patch.

## Files
- `VERDICT.md`   — full mechanism trace with path:line citations
- `fix.diff`     — validate lane_count ∈ {1,2,4} at dp_test_send_link_training
- `build.sh`/`run.sh` — document hardware repro + validate fix.diff applies
- `build.log`    — guest evidence: amdgpu absent, no /dev/dri, only QEMU std-VGA
- `env.txt`, `manifest.json`