# DF-1412 - Verification Verdict

**Status:** reproduced (reproduced=1)
**Impact:** none
**Confidence:** likely

## Finding
bxt_setup_backlight uses VBT-derived controller 0-15 without bounds check for OOB MMIO offset

## Source Location
sys/dev/drm/i915/intel_panel.c:1674-518

## Verdict
Source-confirmed (complex fix): bxt_setup_backlight uses VBT-derived controller 0-15 without bounds ch. No diff in batch.

## Fix Status
not_applicable: source defect confirmed; complex fix not included in batch build

## Summary
bxt_setup_backlight at intel_panel.c:1674: panel->backlight.controller=vbt.backlight.controller (u8:4 bitfield 0-15). BXT_BLC_PWM_CTL(c)=0xC8250+c*0x100 only valid c=0,1. c>=2 -> undefined MMIO offset read/written throughout file. VBT from GPU BIOS/OpROM. Fix: validate controller<=1 in bxt_setup_backlight.