# DF-4049 — dac1/2_output_control_v1 pass uninitialized stack bytes as the VBIOS parameter space

## What

`sys/dev/drm/amd/display/dc/bios/command_table.c:1665-1697`:

```c
static enum bp_result dac1_output_control_v1(struct bios_parser *bp, bool enable)
{
	DISPLAY_DEVICE_OUTPUT_CONTROL_PS_ALLOCATION params;   /* NOT initialized */

	if (enable)
		params.ucAction = ATOM_ENABLE;
	else
		params.ucAction = ATOM_DISABLE;

	if (EXEC_BIOS_CMD_TABLE(DAC1OutputControl, params))
```

`DISPLAY_DEVICE_OUTPUT_CONTROL_PS_ALLOCATION` is 4 bytes — `ucAction` plus
`UCHAR aucPadding[3]` (`sys/dev/drm/amd/include/atombios.h:1657-1667`). Only
offset 0 is written; the 3 padding bytes are **uninitialized kernel stack**
passed by pointer into `amdgpu_atom_execute_table`, where the atom
interpreter exposes the whole PS area to the (untrusted) VBIOS bytecode.
Every other *_control function in this file either memsets its params or
fully populates them (`dac{1,2}_encoder_control_v1` set all three fields of
their 4-byte struct; transmitter/encoder/crtc paths memset). These two
functions are the only uninitialized-PS sites.

## Impact

With an honest VBIOS the padding is never read (no effect). With a crafted
or corrupt VBIOS — the standing threat model for this parser family
(DF-3942, DF-4047) — the interpreter can read the three uninitialized stack
bytes and, e.g., store them to MMIO registers (observable via GPU register
reads / side channels). Kernel-stack bytes → device-visible, not directly
userspace-readable; exploit value is marginal and bounded (3 bytes, adjacent
stack content). Info severity hardening (CWE-457).

## Fix

```diff
-	DISPLAY_DEVICE_OUTPUT_CONTROL_PS_ALLOCATION params;
+	DISPLAY_DEVICE_OUTPUT_CONTROL_PS_ALLOCATION params = {0};
```

in both functions (fix.diff).

## Verification

Source-level (certain); not runnable — hardware-gated (no AMD GPU in guest)
and requires a crafted VBIOS to observe any consumption of the padding
bytes. Status: untested.