{
  "finding_id": "DF-4091",
  "status": "untested",
  "reproduced": 0,
  "impact": "none at kernel-memory level (masked MMIO only); worst case inconsistent CRTC timing -> display corruption/possible pipe hang on real ASIC",
  "confidence": "certain",
  "verdict": "Low - hardware-gated, source-certain (per the dce110-family checklist instruction). dce110_timing_generator_validate_timing (:1109-1163, the CRTC gatekeeper called from dc_validate_stream at core/dc_resource.c:2873) computes h_blank (:1144-1146) and h_back_porch (:1154-1157) with u32 subtractions that wrap on inconsistent timings, so a timing with h_total < h_addressable+borders or h_sync_width > h_front_porch passes the minimums; there are no vertical checks at all. program_blanking (:656-657, :679) wraps identically and set_reg_field_value_ex (dm_services.h:133-141) masks the wrapped values into the H/V blank registers. All sinks in the file are masked MMIO writes to constant addresses; no kernel memory corruption and no division exist in the file. Impact ceiling: garbage CRTC timing on a real ASIC (display corruption / speculative pipe hang). Full-file checklist results in VERDICT.md (set_drr, test patterns, GSL/CRC, disable_vga all bounded/masked). Fix authored; the whole amdgpu.ko module rebuilt -Werror clean with it applied.",
  "exploit_chain": "",
  "evidence": "VERDICT.md (full 6-item checklist), fix.diff, fix_build.log (full untrimmed amdgpu -Werror build log, amdgpu.ko linked)",
  "kernel_refs": [
    "sys/dev/drm/amd/display/dc/dce110/dce110_timing_generator.c:1144",
    "sys/dev/drm/amd/display/dc/dce110/dce110_timing_generator.c:1154",
    "sys/dev/drm/amd/display/dc/dce110/dce110_timing_generator.c:656",
    "sys/dev/drm/amd/display/dc/dce110/dce110_timing_generator.c:679",
    "sys/dev/drm/amd/display/dc/core/dc_resource.c:2873",
    "sys/dev/drm/amd/display/dc/dm_services.h:133"
  ],
  "poc_changes": "n/a (untested)",
  "attempts": 0,
  "guest_uname": null,
  "runtime_sec": null,
  "guest_dirty": 0,
  "build_cmd": null,
  "run_cmd": null,
  "code_hash": null,
  "notes": "Pass-1 sibling dce110_timing_generator_v.c was audited clean with the same masked-MMIO reasoning. Guest /usr/src restored pristine; guest reset with-src.",
  "recommended_fix": "Reject timings whose active+borders exceed h_total/v_total and guard the back-porch subtraction in dce110_timing_generator_validate_timing.",
  "fix_status": "not_testable",
  "fix_baseline_reproduced": 0,
  "fix_patched_reproduced": 0,
  "fix_verdict": "Applied to the guest /usr/src; the complete amdgpu module (which compiles dce110_timing_generator.c) rebuilt with -Werror and linked amdgpu.ko (BUILD_EXIT=0, full log in fix_build.log). Runtime fix validation not testable: no AMD ASIC on this guest.",
  "fix_evidence": "findings/poc/DF-4091/fix.diff, findings/poc/DF-4091/fix_build.log"
}