{
  "finding_id": "DF-3809",
  "status": "untested",
  "reproduced": 0,
  "impact": "none",
  "confidence": "likely",
  "verdict": "intel_enable_ddi_hdmis Display WA #1143 lookup table port_to_transcoder[] has only PORT_A..PORT_E entries but is indexed with encoder->port, which can be PORT_F (5) on GEN9_BC (SKL/KBL/CFL) parts whose SFUSE_STRAP reports DDIF and whose VBT declares the port (encoder created at intel_display.c:14340-14341). The result is a .rodata out-of-bounds read whose garbage value feeds CHICKEN_TRANS(transcoder), i.e. an MMIO write at a wrong register offset during HDMI enable. Not executed: the audit guest has no Intel GPU (no i915 attachment) and the required DDIF-strapped GEN9_BC hardware could not be confirmed to exist; the code defect itself is certain.",
  "exploit_chain": "",
  "evidence": "findings/poc/DF-3809/VERDICT.md (array size vs index proof, init-path citations), findings/poc/DF-3809/env.txt (guest lacks Intel GPU)",
  "kernel_refs": [
    "sys/dev/drm/i915/intel_ddi.c:3180",
    "sys/dev/drm/i915/intel_ddi.c:3187",
    "sys/dev/drm/i915/intel_ddi.c:3173",
    "sys/dev/drm/i915/intel_display.c:14340",
    "sys/dev/drm/i915/i915_drv.h:2562"
  ],
  "poc_changes": "no PoC written; source-level analysis only (no trigger hardware)",
  "attempts": 0,
  "guest_uname": "DragonFly dfbsd 6.5-DEVELOPMENT #0 ... x86_64 (no i915)",
  "runtime_sec": 0,
  "guest_dirty": 0,
  "build_cmd": "",
  "run_cmd": "",
  "code_hash": "",
  "notes": "Pass-2 finding. Guest verification impossible: QEMU std VGA, i915 never attaches (env.txt). Hardware precondition (DDIF strap on GEN9_BC + VBT port F) unconfirmed in the field, hence Low/likely.",
  "recommended_fix": "Add [PORT_F] = TRANSCODER_A to port_to_transcoder[] (or guard port against ARRAY_SIZE) in intel_enable_ddi_hdmi",
  "fix_status": "not_testable",
  "fix_baseline_reproduced": 0,
  "fix_patched_reproduced": 0,
  "fix_verdict": "not_testable: baseline never reproduced (no hardware)",
  "fix_evidence": ""
}