{
  "finding_id": "DF-3628",
  "status": "inconclusive",
  "reproduced": 0,
  "impact": "none",
  "confidence": "likely",
  "verdict": "Source-level confirmed missing validation, runtime inconclusive: bxt_power_sequencer_idx() (sys/dev/drm/i915/intel_dp.c:860-883) returns dev_priv->vbt.backlight.controller verbatim; the field is a raw u8 copied from the VBT LFP backlight control method block (intel_bios.c:333, decl i915_drv.h:1131) with no range check, and is used directly as the pps_idx argument of PP_CONTROL/PP_STATUS/PP_ON_DELAYS/PP_OFF_DELAYS/PP_DIVISOR whose macro expands to pps_mmio_base + reg + pps_idx*0x100 (i915_reg.h:4613-4618). A VBT value >1 (up to 255) makes intel_dp_init_panel_power_sequencer_registers() write panel-sequencing values up to ~64KB beyond the PPS block on BXT (pps_mmio_base=PCH_PPS_BASE 0xC7200 per intel_display.c:14270). MMIO-window misdirection (HW register corruption/DoS), not kernel-RAM corruption. Requires BXT eDP hardware plus a corrupt/malicious VBT (BIOS compromise or root via i915.vbt_firmware, 0400 param), hence Low severity. Guest is virtio-only so no runtime test was possible; i915.ko in /boot/kernel carries the code.",
  "exploit_chain": "",
  "evidence": "README.md (full data-flow chain with citations); fix.diff (clamp at consumer). Decisive lines: intel_dp.c:864 (raw return), 1015 (pps_idx use), i915_reg.h:4613 (pps_idx*0x100 arithmetic), intel_bios.c:333 (unvalidated copy).",
  "kernel_refs": ["sys/dev/drm/i915/intel_dp.c:860", "sys/dev/drm/i915/intel_dp.c:872", "sys/dev/drm/i915/intel_dp.c:1015", "sys/dev/drm/i915/i915_reg.h:4613", "sys/dev/drm/i915/intel_bios.c:333", "sys/dev/drm/i915/i915_drv.h:1131"],
  "poc_changes": "No seed PoC; firmware-trust-boundary finding, hardware-gated.",
  "attempts": 1,
  "guest_uname": "DragonFly dfbsd 6.5-DEVELOPMENT DragonFly 6.5-DEVELOPMENT #0: Thu Jul  2 06:02:54 UTC 2026 root@dfbsd:/usr/obj/usr/src/sys/X86_64_GENERIC x86_64",
  "runtime_sec": 0,
  "guest_dirty": 0,
  "fix_status": "not_testable",
  "fix_baseline_reproduced": 0,
  "fix_patched_reproduced": 0,
  "fix_verdict": "fix.diff clamps the VBT controller to the two valid PPS indices at the intel_dp.c consumer; not build-validated on this guest (needs BXT hardware + crafted VBT).",
  "fix_evidence": "findings/poc/DF-3628/fix.diff",
  "build_cmd": "",
  "run_cmd": "",
  "code_hash": "",
  "notes": "Note: intel_pps_unlock_regs_wa() (intel_display.c:14260) iterates fixed pps_idx 0..1, so only the bxt_power_sequencer_idx() path is affected. Same unchecked pattern exists in upstream Linux of this vintage.",
  "recommended_fix": "Clamp vbt.backlight.controller to 0..1 in bxt_power_sequencer_idx() (or validate it at VBT parse time in intel_bios.c)."
}