# DF-4103 VERDICT

**Status: untested (hardware-gated — no AMD GPU on the audit guest; source-level certainty certain)**
**Impact: kernel panic (NULL-page read at boot; NULL-page write on DPMS-ON). Not exploitable beyond DoS.**

## Root cause

For encoders carrying `ATOM_DEVICE_LCD_SUPPORT`, `enc_priv` is produced by
`amdgpu_atombios_encoder_get_lcd_info()`:

- dce_v8_0.c:3408, dce_v10_0.c:3520, dce_v11_0.c:3652:
  `amdgpu_encoder->enc_priv = amdgpu_atombios_encoder_get_lcd_info(amdgpu_encoder);`

That function (atombios_encoders.c:2069-2206) returns **NULL** when:
1. `amdgpu_atom_parse_data_header(...LVDS_Info...)` fails (atombios_encoders.c:2081)
   — i.e. the VBIOS master data table has no `LVDS_Info` entry — fully
   VBIOS-controlled; or
2. the `kzalloc` at 2085-2086 fails (OOM at boot).

For non-LCD digital encoders, `enc_priv = amdgpu_atombios_encoder_get_dig_info()`
(dce_v10_0.c:3524/3528) also returns NULL on kzalloc failure
(atombios_encoders.c:2212-2215).

Four sinks in this file dereference `enc_priv` with **no NULL check**:

| sink | deref | nature |
|---|---|---|
| `amdgpu_atombios_encoder_setup_dig_transmitter` :837→848 | `dig->dig_encoder` | NULL read |
| `amdgpu_atombios_encoder_setup_dig_encoder` :648→668 | `dig->dig_encoder == -1` | NULL read |
| `amdgpu_atombios_encoder_setup_dig` :1402→1414/1420-1422/1445 | `dig->panel_mode = ...` | **NULL write** |
| `amdgpu_atombios_encoder_set_crtc_source` :1617→1618, :1686→1687 | `dig->dig_encoder` | NULL read |

(Contrast `amdgpu_atombios_encoder_set_backlight_level` :91-93, which *does*
guard `amdgpu_encoder->enc_priv` — the guards were simply never added to the
setup paths.)

## Reachability

- **Boot path (no user action):** `dce_v10_0_hw_init` (dce_v10_0.c:2829) →
  `amdgpu_atombios_encoder_init_dig` (:1744) → unconditional
  `setup_dig_transmitter(ATOM_TRANSMITTER_ACTION_INIT)` for every UNIPHY
  encoder (:1754-1759) → :848 NULL read → panic during driver attach.
- **Runtime path (mode set):** `dce_v10_0_encoder_funcs` dpms helpers
  (dce_v10_0.c:3421/3431) → `amdgpu_atombios_encoder_dpms` (:1477) →
  `setup_dig` (:1397) → :1414 NULL **write** to the `panel_mode` offset.

Trigger: crafted/corrupt VBIOS on an LCD (laptop panel) system, or kzalloc
failure at the wrong instant. Threat model identical to DF-1380/DF-3744
(root-flashed VBIOS or malicious PCIe device ROM). On DragonFly amd64 the
NULL page is unmapped in kernel context → deterministic fatal trap. A
NULL-page *write* at a small fixed offset is not exploitable for code
execution on this platform (no mapping at 0).

## Why untested

The single-tenant QEMU guest has no AMD GPU (`pciconf -l` shows only Intel/
QEMU devices; display is bochs 1234:1111 — see verdict.json notes/env). The
amdgpu driver never probes. Both trigger paths are inside amdgpu attach/
modeset, so no in-guest reproduction is possible without the hardware.
Traced the cited path line-by-line instead; conclusion: real defect,
certain, panic-only impact.

## Fix

Add NULL guards exactly where the backlight path already has one
(atombios_encoders.c:91-93). See fix.diff.

## Fix status (batch validation)
Applied with the 36 sibling fix.diffs of this batch in findings/poc/_batch41/all_fixes.patch; single in-guest `make -j6 nativekernel KERNCONF=X86_64_GENERIC` completed RC=0 with zero errors under -Werror (full log: findings/poc/_batch41/fix_build8.log). Behavior A/B intentionally skipped for this Info-tier item.