{
  "finding_id": "DF-4049",
  "status": "untested",
  "reproduced": 0,
  "impact": "none",
  "confidence": "certain",
  "verdict": "Source-certain CWE-457: dac1_output_control_v1 (command_table.c:1665-1680) and dac2_output_control_v1 (:1682-1697) declare DISPLAY_DEVICE_OUTPUT_CONTROL_PS_ALLOCATION (4 bytes: ucAction + aucPadding[3], atombios.h:1657-1667) without initialization, write only ucAction, and pass the struct by pointer to amdgpu_atom_execute_table - the 3 uninitialized stack padding bytes become VBIOS-readable PS content. With an honest VBIOS the padding is unused; with a crafted/corrupt VBIOS (DF-3942/DF-4047 threat model) the interpreter can consume them (e.g. store to MMIO). Info hardening: no userspace disclosure path demonstrated; in-bounds complement of the known PS-index OOB (DF-1536/DF-1544), not a duplicate. Not verified at runtime: hardware-gated (no AMD GPU) and observation requires a crafted VBIOS - skipped per contract for Info findings.",
  "exploit_chain": "",
  "evidence": "README.md source quotes (command_table.c:1669/:1686 declarations, :1671-1674/:1688-1691 partial init; atombios.h:1657-1667 struct), VERDICT.md",
  "kernel_refs": ["sys/dev/drm/amd/display/dc/bios/command_table.c:1669", "sys/dev/drm/amd/display/dc/bios/command_table.c:1686", "sys/dev/drm/amd/include/atombios.h:1657"],
  "poc_changes": "",
  "attempts": 0,
  "guest_uname": "DragonFly dfbsd 6.5-DEVELOPMENT DragonFly 6.5-DEVELOPMENT #0: Thu Jul  2 06:02:54 UTC 2026 root@dfbsd:/usr/obj/usr/src/sys/X86_64_GENERIC x86_64",
  "runtime_sec": 0,
  "guest_dirty": 0,
  "build_cmd": "",
  "run_cmd": "",
  "code_hash": "",
  "notes": "All other command_table.c PS structs are either memset or fully populated - these two are the only uninit sites (audited exhaustively).",
  "recommended_fix": "Initialize both params structs to zero ({0} or memset) before filling ucAction; see fix.diff",
  "fix_status": "not_testable",
  "fix_baseline_reproduced": 0,
  "fix_patched_reproduced": 0,
  "fix_verdict": "Hardware-gated; one-line zero-init, compile-shape only.",
  "fix_evidence": "findings/poc/DF-4049/fix.diff"
}