{
  "finding_id": "DF-3957",
  "title": "Unguarded enc_priv derefs (NULL-page read AND write) for LCD-supporting digital encoders when radeon_atombios_get_lvds_info returns NULL (missing LVDS_Info table / OOM)",
  "file": "sys/dev/drm/radeon/atombios_encoders.c",
  "severity": "Low",
  "status": "inconclusive",
  "impact_class": "panic (hardware+VBIOS/OOM-gated DoS; NULL-page read/write)",
  "verdict": {
    "reproduced": false,
    "confidence": "likely (source paths certain; NULL requires missing LVDS_Info table or boot OOM)",
    "summary": "radeon_add_atom_encoder :2838/:2872 assigns enc_priv from radeon_atombios_get_lvds_info(), which returns NULL on missing/short LVDS_Info table or kzalloc failure; nine sinks dereference it unguarded, incl. writes at :1744 (dig->panel_mode, NULL+12) and :2663 (dig->dig_encoder = -1, NULL+0).",
    "harness_result": "child1 (:2661-2663 read+write-1): SIGSEGV sig=11; child2 (:1744 write): SIGSEGV sig=11; 'RESULT: NULL-PAGE FAULTS AS PREDICTED (rc=0)'"
  },
  "kernel_refs": [
    "sys/dev/drm/radeon/atombios_encoders.c:742",
    "sys/dev/drm/radeon/atombios_encoders.c:1085",
    "sys/dev/drm/radeon/atombios_encoders.c:1744",
    "sys/dev/drm/radeon/atombios_encoders.c:2006",
    "sys/dev/drm/radeon/atombios_encoders.c:2270",
    "sys/dev/drm/radeon/atombios_encoders.c:2661",
    "sys/dev/drm/radeon/atombios_encoders.c:2872",
    "sys/dev/drm/radeon/radeon_atombios.c:1617"
  ],
  "reproduce": {
    "build": "cd findings/poc/DF-3957 && ./build.sh",
    "run": "cd findings/poc/DF-3957 && ./run.sh",
    "expected": "analysis prints the four offsets (dig_encoder 0, active_mst_links 8, panel_mode 12, backlight_level 16); crash: both children SIGNALLED sig=11, 'RESULT: NULL-PAGE FAULTS AS PREDICTED (rc=0)'"
  },
  "artifacts": [
    "README.md", "VERDICT.md", "trigger_df3957.c", "build.sh", "run.sh",
    "build.log", "run.log", "env.txt", "fix.diff", "manifest.json", "verdict.json"
  ]
}