# DF-3600 — VERDICT

**status: inconclusive (kernel run) / source certain**
**reproduced: 0**

## Proof

* `sq_edc_source_names[]` (gfx_v8_0.c:710-718) has exactly **7** elements
  (INVALID, INST, SGPR, VGPR, LDS, GDS, TA).
* `SQ_EDC_INFO__SOURCE_MASK = 0x1c0`, `__SHIFT = 0x6`
  (gfx_8_0_sh_mask.h:14083-14084) → a **3-bit** field, representable range
  0..7. Encoding 7 is reserved/invalid on the hardware side.
* `gfx_v8_0_parse_sq_irq` :6811 stores the field via REG_GET_FIELD, and the
  DRM_INFO at :6831 evaluates
  `(sq_edc_source != -1) ? sq_edc_source_names[sq_edc_source] : "unavailable"`.
  The only guard is `!= -1` (the ISR-context sentinel); nothing bounds the
  value to the array. Source == 7 → `sq_edc_source_names[7]` reads the rodata
  qword after the array and hands it to `%s`:
  - invalid pointer → fault inside the printk/%s formatter while servicing an
    SQ interrupt (kernel panic in the error handler), or
  - valid pointer → adjacent kernel rodata printed to dmesg (minor static-
    content disclosure).

* Trigger: SQ interrupt with enc 1/2 processed in task context
  (`gfx_v8_0_sq_irq` :6848-6867 → work func :6839-6846) while
  SQ_EDC_INFO.SOURCE latches the reserved encoding 7 — a hardware EDC
  event path, not directly controllable by unprivileged GPU users.
  Severity Low (robustness of an error-reporting path).

## Why not a kernel run

Audit guest is virtio-only (no AMD GPU, no drm/amdgpu module, /boot/modules
absent). `inconclusive` at runtime; index/mask mismatch proven from source
(run.log).

## Fix validation

`fix.diff` bounds the index with `ARRAY_SIZE(sq_edc_source_names)`. Not
buildable on this guest — `fix_status: not_testable`; diff line-matched to
gfx_v8_0.c:6831.

## kernel_refs

- sys/dev/drm/amd/amdgpu/gfx_v8_0.c:710-718 (7-entry array)
- sys/dev/drm/amd/amdgpu/gfx_v8_0.c:6811 (3-bit field read)
- sys/dev/drm/amd/amdgpu/gfx_v8_0.c:6831 (unbounded index + %s)
- sys/dev/drm/amd/include/asic_reg/gca/gfx_8_0_sh_mask.h:14083 (mask 0x1c0)

## Fix status (batch validation)
Applied with the 36 sibling fix.diffs of this batch in findings/poc/_batch41/all_fixes.patch; single in-guest `make -j6 nativekernel KERNCONF=X86_64_GENERIC` completed RC=0 with zero errors under -Werror (full log: findings/poc/_batch41/fix_build8.log). Behavior A/B intentionally skipped for this Info-tier item.