{
  "finding_id": "DF-4047",
  "status": "inconclusive",
  "reproduced": 0,
  "impact": "panic",
  "confidence": "certain",
  "verdict": "Source-certain NULL function-pointer call reachable from BIOS-controlled data: the DCE110/DCE112 command_table_helper tables ship assign_control_parameter/clock_source_id_to_ref_clk_src/transmitter_bp_to_atom = NULL (dce110/command_table_helper_dce110.c, dce112/...dce112.c), and command_table.c selects handlers that call them based solely on VBIOS command revisions - encoder_control_dig1_v1:204 and encoder_control_dig2_v1:219 (assign_control_parameter), transmitter_control_v2:507 (transmitter_bp_to_atom), transmitter_control_v4:678 (clock_source_id_to_ref_clk_src). init_transmitter_control:367-375 additionally switches on UNINITIALIZED stack crev when the command is absent because amdgpu_atom_parse_cmd_header (atom.c:1412-1413) returns false without writing the out-params. Parser selection is itself BIOS-controlled (dal_bios_parser_create, bios_parser_interface.c:35-48, tries firmware_parser_create first and falls back to this v1 parser when the image lacks rom-header v2.2+/object-info v1.4), so a crafted VBIOS chooses both the v1 parser and the old command revisions in one image; on a DCE10/11/11.2 part it then NULL-calls at first encoder/transmitter setup -> kernel page fault/panic. Guest dispatch model (null_helper_dispatch.c) confirms every (DCE, revision) -> NULL-helper mapping plus both negative controls (honest DCE11 revisions and DCE8.0s fully-populated table are safe). Kernel runtime hardware-gated (no AMD GPU in guest) -> status inconclusive per DF-3942 convention; panic impact, Low severity (VBIOS-reflash / VM-ROM threat model).",
  "exploit_chain": "",
  "evidence": "run.log (dispatch model: 4 crafted-revision combos -> named NULL helper; honest-DCE11 and DCE8 controls -> safe), VERDICT.md path:line chain, dce110/command_table_helper_dce110.c NULL entries quoted in README.md",
  "kernel_refs": [
    "sys/dev/drm/amd/display/dc/bios/command_table.c:204",
    "sys/dev/drm/amd/display/dc/bios/command_table.c:219",
    "sys/dev/drm/amd/display/dc/bios/command_table.c:367",
    "sys/dev/drm/amd/display/dc/bios/command_table.c:507",
    "sys/dev/drm/amd/display/dc/bios/command_table.c:678",
    "sys/dev/drm/amd/display/dc/bios/command_table_helper.c:38",
    "sys/dev/drm/amd/display/dc/bios/dce110/command_table_helper_dce110.c",
    "sys/dev/drm/amd/display/dc/bios/dce112/command_table_helper_dce112.c",
    "sys/dev/drm/amd/display/dc/bios/bios_parser_interface.c:35",
    "sys/dev/drm/amd/amdgpu/atom.c:1405"
  ],
  "poc_changes": "n/a (authored fresh: userland dispatch model, no kernel changes)",
  "attempts": 1,
  "guest_uname": "DragonFly dfbsd 6.5-DEVELOPMENT DragonFly 6.5-DEVELOPMENT #0: Thu Jul  2 06:02:54 UTC 2026 root@dfbsd:/usr/obj/usr/src/sys/X86_64_GENERIC x86_64",
  "runtime_sec": 5,
  "guest_dirty": 0,
  "build_cmd": "cc -O2 -Wall -o null_helper_dispatch null_helper_dispatch.c",
  "run_cmd": "/root/df4047/null_helper_dispatch",
  "code_hash": "27cce1c0026192a5f83ce1a6fbcbc5f2532b30d8600b1352efaf5fa2f2a40412",
  "notes": "Checklist item (c)/(d) of this audit. dce80 helper table is fully populated - only DCE10/11/11.2 are affected. Threat model equals DF-3942 (crafted/corrupt VBIOS image). Checklist items (e) gpio/memory-training index math and (f) div0 in clock commands were audited and killed: no index math exists in this file and adjust_display_pll_v3 guards its division (command_table.c:1514-1521).",
  "recommended_fix": "init_transmitter_control: zero-init frev/crev and refuse crev 2/4 when the helper entry is NULL; init_encoder_control_dig_v1: require assign_control_parameter != NULL (see fix.diff)",
  "fix_status": "not_testable",
  "fix_baseline_reproduced": 0,
  "fix_patched_reproduced": 0,
  "fix_verdict": "In-kernel fix validation impossible on this guest (no AMD GPU; no amdgpu attach). fix.diff is a compile-shape guard (zero-init + NULL checks at dispatch), verified only at source level.",
  "fix_evidence": "findings/poc/DF-4047/fix.diff"
}