# DF-3627 — Uninitialized stack array consumed as eDP link rates when DPCD read fails

- **File:** `sys/dev/drm/i915/intel_dp.c:3947-3969` (`intel_edp_init_dpcd`)
- **Class:** CWE-457 (use of uninitialized memory), sink-triggered
- **Severity:** Low (no OOB, no userland leak; garbage control data only)
- **Status:** `inconclusive` on the audit guest (virtio-only; eDP path needs an
  internal panel on Intel hardware). Source-level certain.

## What happens

```c
	if (intel_dp->edp_dpcd[0] >= DP_EDP_14) {
		__le16 sink_rates[DP_MAX_SUPPORTED_RATES];   /* 8 x u16, UNINITIALIZED */
		int i;

		drm_dp_dpcd_read(&intel_dp->aux, DP_SUPPORTED_LINK_RATES,
				sink_rates, sizeof(sink_rates));   /* return value IGNORED */

		for (i = 0; i < ARRAY_SIZE(sink_rates); i++) {
			int val = le16_to_cpu(sink_rates[i]);
			if (val == 0)
				break;
			intel_dp->sink_rates[i] = (val * 200) / 10;
		}
		intel_dp->num_sink_rates = i;
	}
```

`intel_edp_init_dpcd()` runs at eDP connector init / detect. `edp_dpcd[0] >=
DP_EDP_14` is itself sink-supplied. If the AUX read of
`DP_SUPPORTED_LINK_RATES` fails (short read, timeout, defer — a misbehaving
or malicious panel controls this), the stack array is left untouched and its
garbage contents are interpreted as link rates:

- garbage flows into `intel_dp->sink_rates[0..7]` and `num_sink_rates` (≤ 8,
  writes bounded by `DP_MAX_SUPPORTED_RATES` — **no OOB write**);
- `intel_dp_set_common_rates()` intersects them with source rates
  (`intersect_rates`, bounded, `WARN_ON(k >= DP_MAX_SUPPORTED_RATES)`) so only
  values that exactly match a known-good source rate survive; otherwise
  `num_common_rates == 0` falls back to 162000 (intel_dp.c:536-539).

So the practical effect is **uninitialized kernel stack used as control
data**: nondeterministic link-rate selection / spurious training failures,
plus MSan-detectable UB. No information disclosure path exists — the values
are only ever compared against kernel constants
(`intel_dp_print_rates` logs only *common* rates, which are source constants).

The same unchecked read exists in upstream Linux of this vintage (inherited).

## Fix

Check the read result and zero-initialize the array (see `fix.diff`).

## Runtime verification

Not possible on this guest: the eDP/`intel_edp_init_dpcd` path requires Intel
display hardware with an internal panel; the guest's GPU is virtio
(`chip=0x1111:1234`) and i915 never attaches. Marked `inconclusive` per the
honest-status policy; the code ships in `/boot/kernel/i915.ko`.