# DF-3901 VERDICT

**Status: inconclusive (source-certain; hardware-gated, not runnable on this guest)**
**reproduced: 0 · impact: none (worst case hw-gated display misconfig/DoS) · confidence: certain**

## Proof from source

1. `skl_dram_get_channels_info()` — i915_drv.c:1219:
   `struct dram_channel_info ch0, ch1;` — **no initializer**.
2. `skl_dram_get_channel_info()` — i915_drv.c:1154-1202: returns `-EINVAL`
   at :1160 (`if (!val)`) or :1165-1166 (`tmp_l == 0 && tmp_s == 0`) **before
   writing any field of `*ch`**. A blank MAD_DIMM channel register (empty DIMM
   slot on single-channel SKL/KBL) triggers exactly this.
3. Caller consumes the failed channel unconditionally after only checking
   `num_channels != 0` (both-blank case):
   - :1243-1244 `ch0.rank` / `ch1.rank` compare
   - :1247 `max(ch0.rank, ch1.rank)` → `dram_info->rank`
   - :1254 `ch0.is_16gb_dimm || ch1.is_16gb_dimm` → `dram_info->is_16gb_dimm`
   - :1256 `intel_is_dram_symmetric(val_ch0, val_ch1, &ch0)` (:1205-1213)
     reads `ch0->s_info.size/width/rank`
4. `dram_info->rank/is_16gb_dimm/symmetric_memory` feed SKL watermark
   latency logic (intel_pm.c skl_wm_* consumes `dram_info->is_16gb_dimm`
   for the level-0 latency w/a) → wrong values = mis-programmed watermarks
   on the affected configs.

Reached from `i915_driver_init_hw()` → `intel_get_dram_info()` (:1547) on
every driver load on gen9 non-LP with one blank MAD_DIMM channel.

Upstream parity: later Linux (intel_dram.c) initializes `ch0 = {}, ch1 = {}`
and reworks this exact function — the `= {}` is the hardening this port lacks.

## Why not live-verified

Guest has virtio VGA; the i915 path never executes. No /dev/dri. Recorded
`inconclusive` (same as DF-3634 for its guest-unreachable half).

## Exploit chain

None. Not attacker-controllable; no corruption; no disclosure of the uninit
bytes to userspace (they only steer internal watermark arithmetic).

## Fix validation

Not applicable (no reproduced memory corruption). fix.diff zeroes the structs
and bails out of the channel when the register is blank — mirrors upstream.
fix_status: not_applicable.

## kernel_refs

- sys/dev/drm/i915/i915_drv.c:1219 (uninit decl)
- sys/dev/drm/i915/i915_drv.c:1154-1166 (early -EINVAL before any field write)
- sys/dev/drm/i915/i915_drv.c:1243-1247 (rank consumption)
- sys/dev/drm/i915/i915_drv.c:1254-1258 (is_16gb_dimm / symmetric consumption)
- sys/dev/drm/i915/i915_drv.c:1397-1406 (intel_get_dram_info dispatch)

## Fix status (batch validation)
Applied with the 36 sibling fix.diffs of this batch in findings/poc/_batch41/all_fixes.patch; single in-guest `make -j6 nativekernel KERNCONF=X86_64_GENERIC` completed RC=0 with zero errors under -Werror (full log: findings/poc/_batch41/fix_build8.log). Behavior A/B intentionally skipped for this Info-tier item.