{
  "finding_id": "DF-3627",
  "status": "inconclusive",
  "reproduced": 0,
  "impact": "none",
  "confidence": "certain",
  "verdict": "Source-level certain, runtime inconclusive: intel_edp_init_dpcd() (sys/dev/drm/i915/intel_dp.c:3948-3969) ignores the return value of drm_dp_dpcd_read() into the uninitialized __le16 sink_rates[8] stack array; on read failure (sink-controlled: a flaky/hostile eDP panel) garbage stack data is converted into intel_dp->sink_rates[] / num_sink_rates control data. Writes are bounded by DP_MAX_SUPPORTED_RATES (no OOB) and values are subsequently filtered by intersection with kernel-known source rates (no userspace disclosure), so the impact ceiling is nondeterministic link-rate selection and spurious training failures plus MSan-visible UB. Not runnable on this guest: the eDP path requires Intel display hardware with an internal panel; guest GPU is virtio (0x1111:1234) and i915 never attaches. Code ships in /boot/kernel/i915.ko.",
  "exploit_chain": "",
  "evidence": "README.md (code excerpt + data-flow + bounds analysis); fix.diff (memset-on-failed-read). Decisive lines: intel_dp.c:3949 (uninit decl), 3952-3953 (unchecked read), 3955-3969 (garbage consumed).",
  "kernel_refs": [
    "sys/dev/drm/i915/intel_dp.c:3948",
    "sys/dev/drm/i915/intel_dp.c:3952",
    "sys/dev/drm/i915/intel_dp.c:3967",
    "sys/dev/drm/i915/intel_dp.c:529",
    "sys/dev/drm/i915/intel_dp.c:536"
  ],
  "poc_changes": "No seed PoC; pure source-analysis finding with a hardening fix.",
  "attempts": 1,
  "guest_uname": "DragonFly dfbsd 6.5-DEVELOPMENT DragonFly 6.5-DEVELOPMENT #0: Thu Jul  2 06:02:54 UTC 2026 root@dfbsd:/usr/obj/usr/src/sys/X86_64_GENERIC x86_64",
  "runtime_sec": 0,
  "guest_dirty": 0,
  "fix_status": "not_testable",
  "fix_baseline_reproduced": 0,
  "fix_patched_reproduced": 0,
  "fix_verdict": "fix.diff zeroes sink_rates when the DPCD read does not return the full 16 bytes; not build-validated on this guest (target path needs Intel eDP hardware).",
  "fix_evidence": "findings/poc/DF-3627/fix.diff",
  "build_cmd": "",
  "run_cmd": "",
  "code_hash": "",
  "notes": "Upstream-inherited (Linux 4.14-era intel_dp.c identical). Guest virtio-only; module presence proven via /boot/kernel/i915.ko.",
  "recommended_fix": "Treat a failed DP_SUPPORTED_LINK_RATES read as no rates (memset/zero) in intel_edp_init_dpcd."
}