DF-3870 / verdict.json
{ "finding_id": "DF-3870", "status": "inconclusive", "reproduced": 0, "impact": "dos", "confidence": "speculative", "verdict": "vram_width/dram_channel_width integer truncation can yield 0 dram channels; number_of_dram_channels is used as a bw_div/bw_mod divisor in calculate_bandwidth -> kernel #DE. Requires a misdetecting VBIOS/board (hardware-gated); defensive clamp recommended.", "exploit_chain": "", "evidence": "VERDICT.md source chain; dce_calcs.c:2041->1185/1098", "kernel_refs": [ "sys/dev/drm/amd/display/dc/calcs/dce_calcs.c:2041", "sys/dev/drm/amd/display/dc/calcs/dce_calcs.c:1185", "sys/dev/drm/amd/display/dc/calcs/dce_calcs.c:1098" ], "poc_changes": "no runnable PoC (hardware-gated)", "attempts": 0, "guest_uname": "DragonFly dfbsd 6.5-DEVELOPMENT x86_64 (no AMD GPU)", "runtime_sec": 0, "guest_dirty": 0, "build_cmd": "", "run_cmd": "", "code_hash": "", "notes": "Low severity: needs abnormal vram_width detection; normal boards are unaffected", "recommended_fix": "clamp number_of_dram_channels to >=1 in bw_calcs_init", "fix_status": "not_testable", "fix_baseline_reproduced": 0, "fix_patched_reproduced": 0, "fix_verdict": "one-line clamp, cannot validate on guest", "fix_evidence": "fix.diff" } |