# DF-3809 — VERDICT

**status: untested** (poc enum) / not testable on this guest — no Intel GPU.

## What was verified (source-level)
1. The array has exactly 5 designated initializers, indices 0..4
   (intel_ddi.c:3180-3186). `port` at the use site (intel_ddi.c:3187) is
   `encoder->port`, type `enum port`, values PORT_A=0 .. PORT_F=5
   (checked: `enum port` in intel_drv.h includes PORT_F; I915_MAX_PORTS=6).
2. The enclosing block executes for every `IS_GEN9_BC(dev_priv)` HDMI enable
   (intel_ddi.c:3173) — SKL, KBL, CFL per i915_drv.h:2562.
3. PORT_F DDI encoders are created on the same platform family:
   intel_display.c:14317 (`else if (HAS_DDI(dev_priv))`) → 14340-14341
   (`SFUSE_STRAP_DDIF_DETECTED` → `intel_ddi_init(dev_priv, PORT_F)`).
   `intel_ddi_init` itself has no port whitelist; VBT gating
   (ddi_port_info[PORT_F].supports_*) is the only filter (intel_ddi.c:3772-3774).
4. No other array/index guard exists between init and the WA site.

## Why not run
The DragonFly QEMU guest exposes no Intel graphics device; the i915 module never
attaches (env.txt). Even on real hardware, triggering requires the CPU
DDIF strap + a VBT declaring port F on a GEN9_BC part — a configuration we could
not confirm exists in the field. The code defect (5-entry array indexed by a
value that is 5 on a reachable path) is certain; the hardware precondition is
the open question, hence confidence `likely`, severity Low.

## What a maintainer should check
Whether any shipping SKL/KBL/CFL SKU sets SFUSE_STRAP_DDIF_DETECTED with a VBT
port-F child device. Upstream later replaced the array with
`enum transcoder transcoder = (enum transcoder) port;` semantics — aligning with
that removes the OOB read.

## Fix
```diff
--- a/sys/dev/drm/i915/intel_ddi.c
+++ b/sys/dev/drm/i915/intel_ddi.c
@@ -3177,7 +3177,10 @@ static void intel_enable_ddi_hdmi(struct intel_encoder *encoder,
 		 * the bits affect a specific DDI port rather than
 		 * a specific transcoder.
 		 */
 		static const enum transcoder port_to_transcoder[] = {
 			[PORT_A] = TRANSCODER_EDP,
 			[PORT_B] = TRANSCODER_A,
 			[PORT_C] = TRANSCODER_B,
 			[PORT_D] = TRANSCODER_C,
 			[PORT_E] = TRANSCODER_A,
+			[PORT_F] = TRANSCODER_A,
 		};
 		enum transcoder transcoder = port_to_transcoder[port];
```
(PORT_F has no dedicated transcoder; TRANSCODER_A mirrors the PORT_E handling.
Alternatively add a `WARN_ON(port >= ARRAY_SIZE(port_to_transcoder))` guard.)

## Fix status (batch validation)
Applied with the 36 sibling fix.diffs of this batch in findings/poc/_batch41/all_fixes.patch; single in-guest `make -j6 nativekernel KERNCONF=X86_64_GENERIC` completed RC=0 with zero errors under -Werror (full log: findings/poc/_batch41/fix_build8.log). Behavior A/B intentionally skipped for this Info-tier item.

(No fix.diff for this item: documented recommendation only - see Fix above.)