{
  "finding_id": "DF-3899",
  "title": "Off-by-one bounds guard in intel_get_shared_dpll_id() lets a one-past-end pointer yield an out-of-range PLL id",
  "severity": "Info",
  "bucket": "base:dev",
  "verdict": "untested",
  "impact": "none",
  "confidence": "certain",
  "verdict_paragraph": "Guard uses '>' where '>=' is required; exactly-one-past-end pointer returns id == num_shared_dpll (7 == I915_NUM_PLLS on ICL, OOB). Unreachable with current callers (all pass in-array or NULL pointers); defense-in-depth fix mirrors upstream index-based rewrite. No runtime test possible on the QEMU guest.",
  "kernel_refs": [
    "sys/dev/drm/i915/intel_dpll_mgr.c:99",
    "sys/dev/drm/i915/intel_dpll_mgr.c:103",
    "sys/dev/drm/i915/intel_dpll_mgr.c:107",
    "sys/dev/drm/i915/intel_ddi.c:1617",
    "sys/dev/drm/i915/i915_drv.h:1793"
  ],
  "reproduce": {
    "build": "n/a — source-level finding; requires Intel i915 display hardware and a caller passing &shared_dplls[num_shared_dpll], which none currently does",
    "run": "n/a",
    "expected": "n/a"
  },
  "artifacts": [
    "README.md",
    "VERDICT.md",
    "fix.diff",
    "verdict.json",
    "manifest.json"
  ]
}