# DF-3946 — Verification Verdict

**Status:** inconclusive (hardware-gated; source-level chain certain)
**Impact demonstrated:** none (panic expected on hardware)
**Confidence:** certain (source), runtime not testable on this guest

## Reproduction environment

- Audit guest: DragonFly x86-64 QEMU/KVM VM — **no AMD GPU / no DRI adapter**,
  so the DRM/amdgpu path cannot execute at all. `trigger_dce110_headplane.c`
  compile-verifies only (see build.log).
- Target hardware class: any amdgpu pre-DCN10 ASIC (DCE80/100/110/112/120):
  Oland/Tonga/Fiji/Carrizo/Stoney/Polaris/Vega10 — all five hwss variants
  inherit `dce110_apply_ctx_for_surface` (verified: no override in
  dce80/dce100/dce112/dce120 funcs tables).

## Why the bug is certain at source level (path:line)

| # | Fact | Reference |
|---|------|-----------|
| 1 | Removing a head-pipe plane sets `plane_state = NULL`, keeps `stream` | `sys/dev/drm/amd/display/dc/core/dc_resource.c:1462-1467` |
| 2 | Unprivileged KMS user can drive step 1 via atomic plane-disable | `sys/dev/drm/amd/display/amdgpu_dm/amdgpu_dm.c:5426` (`dc_remove_plane_from_context`) |
| 3 | Commit tail always calls `dc_commit_state` for plane-updating commits | `amdgpu_dm.c:4837` with `dc_state` from `dm_state->context` (`amdgpu_dm.c:4752-4755`) |
| 4 | `dc_commit_state` calls `apply_ctx_for_surface` per remaining stream (plane_count ≥ 1 while overlay survives) | `core/dc.c:955-959` and `:992-997` |
| 5 | `dce110_apply_ctx_for_surface` walks pipes by `stream` match only — no `plane_state` check | `dce110_hw_sequencer.c:2743-2763` |
| 6 | First NULL deref | `set_default_colors` → `dce110_hw_sequencer.c:2100` (`pipe_ctx->plane_state->color_space`), reached from line 2619 via 2757 |
| 7 | The state is guarded in sibling code (state is real & anticipated) | `core/dc.c:1521-1522`; `dcn10_hw_sequencer.c:2386-2391`; `core/dc_stream.c:251-256` |

Conclusion: NULL-pointer read at a small constant offset → kernel page
fault → panic. Read-only primitive (color_space/format/update_flags reads);
no corruption-controlled write → local DoS (Medium), not an escalation path.

## Why not reproduced / not false-positive

- not-reproducible-on-guest: QEMU has no AMD display adapter; amdgpu module
  has nothing to bind. This is a hardware prerequisite, not a code-path
  liveness issue: every hop of the chain above exists in this tree.
- not-false-positive: the producer (`dc_remove_plane_from_context` head-pipe
  detach) and the unguarded consumer are both live code on the same commit
  path; DCN10's own handler demonstrates the intended guard.

## Fix validation

fix.diff authored (guard added in `dce110_apply_ctx_for_surface` program
loop, mirroring `core/dc.c:1521`). Kernel rebuild + on-hardware validation
not possible on this guest → fix_status: not_testable.

## Fix status (batch validation)
Applied with the 36 sibling fix.diffs of this batch in findings/poc/_batch41/all_fixes.patch; single in-guest `make -j6 nativekernel KERNCONF=X86_64_GENERIC` completed RC=0 with zero errors under -Werror (full log: findings/poc/_batch41/fix_build8.log). Behavior A/B intentionally skipped for this Info-tier item.