{
  "finding_id": "DF-4104",
  "status": "untested",
  "reproduced": 0,
  "impact": "none",
  "confidence": "certain",
  "verdict": "Source-level certain: amdgpu_atombios_encoder_get_lcd_info (atombios_encoders.c:2083-2131) reads sizeof(ATOM_LVDS_INFO) (0x2C) bytes at bios+data_offset where data_offset is an unvalidated u16 from the VBIOS master data table - amdgpu_atom_parse_data_header (atom.c:1384-1403) never compares it against the image size and struct atom_context (atom.h:126-144) carries no bios_size. The bios heap buffer is image-sized (amdgpu_bios.c:172-179,135-141), so a table declared near the end of e.g. a 32KB image drives ~44 bytes of fixed-struct reads past the allocation. Distinct from DF-1380 (record-walk loop) - these reads precede the walk and have a different fix. Untestable on the audit guest: no AMD GPU present.",
  "exploit_chain": "",
  "evidence": "VERDICT.md steps 1-4; the size=NULL call at atombios_encoders.c:2081; struct layout at sys/dev/drm/amd/include/atombios.h:3898-3917.",
  "kernel_refs": [
    "sys/dev/drm/amd/amdgpu/atombios_encoders.c:2081",
    "sys/dev/drm/amd/amdgpu/atombios_encoders.c:2083",
    "sys/dev/drm/amd/amdgpu/atombios_encoders.c:2091",
    "sys/dev/drm/amd/amdgpu/atombios_encoders.c:2131",
    "sys/dev/drm/amd/amdgpu/atom.c:1384",
    "sys/dev/drm/amd/amdgpu/atom.h:126",
    "sys/dev/drm/amd/amdgpu/amdgpu_bios.c:174"
  ],
  "poc_changes": "No runnable PoC (hardware absent); pack is the source trace + fix.",
  "attempts": 0,
  "guest_uname": "DragonFly dfbsd 6.5-DEVELOPMENT #0: Thu Jul 2 06:02:54 UTC 2026 x86_64 (no AMD GPU: pciconf -l shows bochs 1234:1111)",
  "runtime_sec": 0,
  "guest_dirty": 0,
  "build_cmd": "",
  "run_cmd": "",
  "code_hash": "",
  "notes": "Hardware-gated (crafted VBIOS via root flash / malicious option ROM). radeon twin family: DF-3745, DF-1408. Read-only primitive feeding panel-timing + lcd_ss_id state (SS-id consumer div0 family lives in atombios_crtc.c:789, separate file).",
  "recommended_fix": "Plumb bios_size into atom_context and reject data tables whose offset+struct-size exceeds the image (fix.diff).",
  "fix_status": "not_testable",
  "fix_baseline_reproduced": 0,
  "fix_patched_reproduced": 0,
  "fix_verdict": "fix.diff bounds-checks the LVDS_Info data_offset (and data-table header) against a newly-plumbed bios_size; not kernel-buildable on the guest because amdgpu cannot attach (no hardware).",
  "fix_evidence": "findings/poc/DF-4104/fix.diff"
}