# DF-4049 VERDICT — uninitialized PS padding in dac output control

## Status: untested (source-certain defect; Info severity)

- Defect certain from source: `command_table.c:1669` and `:1686` declare
  `DISPLAY_DEVICE_OUTPUT_CONTROL_PS_ALLOCATION params;` without
  initialization; only `ucAction` (offset 0) is assigned (`:1671-1674`,
  `:1688-1691`) and the struct is 4 bytes with 3 bytes of `aucPadding`
  (`atombios.h:1657-1667`). The pointer is handed to
  `amdgpu_atom_execute_table` (`:1676`, `:1693`), which exposes the full PS
  area to VBIOS bytecode (the same interpreter whose unbounded PS indexing
  is the known DF-1536/DF-1544; this finding is the *in-bounds* uninit-read
  complement, not a duplicate of the OOB index issue).
- Not runnable: guest has no AMD GPU; observing consumption of the padding
  requires a crafted VBIOS. No runtime verification attempted (Info-level
  hardening finding — skipped per contract).
- Impact ceiling: 3 uninitialized kernel-stack bytes made
  device-register-visible under a crafted VBIOS; no userspace disclosure
  path demonstrated.

## Fix status (batch validation)
Applied with the 36 sibling fix.diffs of this batch in findings/poc/_batch41/all_fixes.patch; single in-guest `make -j6 nativekernel KERNCONF=X86_64_GENERIC` completed RC=0 with zero errors under -Werror (full log: findings/poc/_batch41/fix_build8.log). Behavior A/B intentionally skipped for this Info-tier item.