# DF-4091 VERDICT

**Status:** untested — hardware-gated (no AMD ASIC on the audit guest;
`vgapci0 ... chip=0x11111234` is QEMU std VGA, `env.txt`). Source-level
certainty, per the dce110-family checklist instruction.
**Confidence:** certain (arithmetic defects); impact ceiling speculative
(no hardware to observe a misprogrammed CRTC).

## What was checked (whole file, 2261 lines)

- **(a) program_timing / program_blanking arithmetic** (`:281-353`,
  `:596-697`): all h/v sync-start and blank-start/end computations can wrap
  (u32) on inconsistent timings, but every sink is
  `set_reg_field_value_ex` (`dm_services.h:133-141`) which masks to the
  register field width before `dm_write_reg` to a *constant* address
  (`CRTC_REG`/`DCP_REG` + fixed offsets). No kernel-memory effect is
  reachable from timing values. No division exists in the file (DF-3828
  watermark-div0 class absent).
- **(b) set_drr / vtotal bounds** (`:366-468`): `vertical_total_max/min`
  zero-checked (`:387-389`); `-1` values masked into fields. Benign.
- **(c) test pattern generators** (`:699-1102`): fixed arrays
  `src_color[6]`/`dst_color[6]`, loops bounded by 6; shifts
  `src_bpc - dst_bpc` ∈ {6,8,10}, `16 - dst_bpc` ∈ {6,8,10}; no UB.
- **(d) validate_timing** (`:1109-1163`): the finding — `h_blank`
  (`:1144-1146`) and `h_back_porch` (`:1154-1157`) underflow past their
  minimum checks; zero vertical checks. Gatekeeper called at
  `core/dc_resource.c:2873` (`dc_validate_stream`).
- **(e) DCCG/clock source**: not touched by this file (no clock-source
  interaction code present) — n/a.
- **(f) globalsync / crc** (`:1214-1382`, `:2094-2197`):
  `check_point - FLIP_READY_BACK_LOOKUP` (`:1300`) can underflow only if the
  CRTC V_TOTAL register reads < 3 (hardware state, not user timing) — masked
  anyway. CRC window values are pure masked field writes (`:2116-2157`).
  `disable_vga` (`:1797-1836`) leaves `addr = 0` on an unknown
  `controller_id`, but `dce110_timing_generator_construct:2245` derives the
  id as `CONTROLLER_ID_D0 + instance` with instance bounded by the resource
  pool (≤ 6 pipes) — default case unreachable in practice.

## Verification performed

- No amdgpu device in the guest ⇒ no runtime run; the module builds and the
  file's logic is fully source-traceable (all sinks masked register writes).
- `fix.diff` applied to the guest `/usr/src`; the complete `amdgpu` module
  (which compiles `dce110_timing_generator.c`) rebuilt with `-Werror` and
  linked `amdgpu.ko` (BUILD_EXIT=0; `fix_build.log` — full untrimmed
  build log). `/usr/src` restored pristine afterwards; guest reset with the
  clean-source snapshot.

## Fix status (batch validation)
Applied with the 36 sibling fix.diffs of this batch in findings/poc/_batch41/all_fixes.patch; single in-guest `make -j6 nativekernel KERNCONF=X86_64_GENERIC` completed RC=0 with zero errors under -Werror (full log: findings/poc/_batch41/fix_build8.log). Behavior A/B intentionally skipped for this Info-tier item.