# DF-3791 VERDICT

**Status: inconclusive** (runtime verification impossible on this guest — no
DRM device exists; source-level divergence is *certain*).
**Source-level severity: Low** (availability / local DoS of the display
subsystem; no memory corruption, no info leak, no privilege impact).

## What was verified

### 1. The bug is real in this tree (certain)

This file (`sys/dev/drm/drm_atomic_helper.c`, 4021 LOC) is byte-comparable to
upstream Linux ~v5.0-rc1 (drm-misc window Nov 2018 – Jan 2019) except for a
small set of deltas. Two independent checks establish the vintage:
`pick_single_encoder_for_connector` / `max_requested_bpc` / damage-helper
(v5.0-final features) are absent, while `__drm_atomic_helper_set_config`,
`fake_vblank`, `commit_cleanup_done` and the `2216322919c8` async-fb block
(pre-v5.0-final features) are present.

Upstream commit **022debad063e** "drm/atomic: Add drm_atomic_state->duplicated"
(merged for v5.2) is NOT carried:

* local `update_connector_routing()` rejects duplicated states on
  unregistered connectors — `sys/dev/drm/drm_atomic_helper.c:325-329`,
  upstream adds `!state->duplicated &&` here;
* local `drm_atomic_helper_duplicate_state()` —
  `sys/dev/drm/drm_atomic_helper.c:3840-3901` — sets no such flag; the field
  `drm_atomic_state.duplicated` does not exist anywhere under
  `sys/dev/drm/include/` (`rg -n duplicated` → no hits).

Upstream added that flag specifically because resume-through-duplicated-state
must ignore connector unregistration; without it the atomic check run inside
`drm_atomic_commit()` (invoked from `drm_atomic_helper_commit_duplicated_state`,
`sys/dev/drm/drm_atomic_helper.c:3252`) returns -EINVAL and the whole resume
update is aborted — nothing is swapped in, no outputs are programmed.

### 2. Reachability in-tree (likely, hardware-dependent)

`drm_atomic_helper_suspend/resume` are used by the two KMS drivers DFly
actually ships for real hardware:

* amdgpu (DC): `sys/dev/drm/amd/display/amdgpu_dm/amdgpu_dm.c:710`
  (`adev->dm.cached_state = drm_atomic_helper_suspend(adev->ddev)`) and
  `:908` (`drm_atomic_helper_resume(ddev, dm->cached_state)`).
* i915: `sys/dev/drm/i915/intel_display.c:6381`.

Trigger: suspend with outputs configured → connector unregistered while
suspended (DP cable yanked, USB-C/DP dock removed, DP-MST topology vanished —
MST is the classic case the upstream commit describes) → resume. Result:
`[CONNECTOR:n:...] is not registered` → -EINVAL → displays stay off; the
kernel console is unusable until userspace performs a *fresh* modeset.
Impact ceiling: local availability (display DoS) — recoverable, no memory
corruption.

### 3. Why runtime verification is impossible here (inconclusive)

Guest survey (`env.txt`):

* `ls /dev/dri` → No such file or directory; `ls /dev/drm*` → none.
* `pciconf -l` → only `vgapci0@pci0:0:2.0 chip=0x11111234` (QEMU std VGA).
  The DFly tree contains **no virtio_gpu driver**
  (`sys/dev/virtual/virtio/{balloon,block,net,pci,random,scsi}` only) and no
  driver for the emulated std VGA, so no DRM device can exist on this guest.
* `kldstat` → drm.ko not loaded (modules exist in /boot/kernel but nothing
  can attach).

Both findings of this audit are therefore proven by source diff against the
upstream fix, not by guest execution. No panic/log sample exists; `fix.diff`
is provided un-applied per audit rules.

## Exploit chain

None — not a memory-corruption class. Availability-only.

## Recommended fix

Backport upstream commit 022debad063e (add `duplicated` to
`struct drm_atomic_state`, set it in `drm_atomic_helper_duplicate_state`,
gate the check in `update_connector_routing`). See `fix.diff` in this pack.

## Fix status (batch validation)
Applied with the 36 sibling fix.diffs of this batch in findings/poc/_batch41/all_fixes.patch; single in-guest `make -j6 nativekernel KERNCONF=X86_64_GENERIC` completed RC=0 with zero errors under -Werror (full log: findings/poc/_batch41/fix_build8.log). Behavior A/B intentionally skipped for this Info-tier item.