# DF-4105 VERDICT

**Status: untested (hardware-gated — no AMD GPU on the audit guest; source-level certainty certain)**
**Impact: conditional kernel-heap info leak to unprivileged userspace (≤127 bytes, ~1/256 per boot) + up-to-32KB OOB heap read probe during validation.**

## Trace

- `amdgpu_atombios_encoder_get_lcd_info` record walk
  (atombios_encoders.c:2156) reaches a `LCD_FAKE_EDID_PATCH_RECORD_TYPE`
  record (2167).
- `edid = kmalloc(max(128, len))` at 2173 — plain kmalloc, **no zeroing**.
- `memcpy(edid, ..., len)` at 2175-2176 initializes only `len` bytes.
- `drm_edid_is_valid(edid)` at 2178 (drm_edid.c:1484): reads
  `edid->extensions` = byte 126 (uninit when len ≤ 126) and walks
  `raw + i*128` for i in [0, extensions] — each block fully read
  (header + checksum) before rejection → OOB read past the chunk when
  garbage extensions != 0 (likely for random heap: ~99.6%).
- On block-0 checksum pass (~1/256 with random tail): cached as
  `bios_hardcoded_edid` (2179-2180).
- Userspace readback: `amdgpu_connector_get_edid`
  (amdgpu_connectors.c:269-274) duplicates the full 128-byte buffer (tail
  included) into the connector EDID → returned via the standard
  GETCONNECTOR ioctl / debugfs EDID node, readable by any local user.

Reachability gate: crafted VBIOS with a fake-EDID record whose declared
length is < 128 (or ≤ 126 for the extensions variant). Same threat model
as DF-1380 (root-flashed VBIOS / malicious option ROM) — hence Low
severity, consistent with DF-1380's rating.

Not DF-1380: DF-1380's fix (bound the record pointer vs bios_end before
the walk and before the memcpy) does NOT touch this — the leak source is
the *destination* buffer's uninitialized tail, fixed by kzalloc.

## Why untested
Guest has no AMD GPU (bochs 1234:1111 only); the record walk never
executes. Source trace is line-exact.

## Fix
`edid = kzalloc(edid_size, M_DRM, GFP_KERNEL);` — zero-initialize so the
tail cannot leak heap contents and `edid->extensions` is deterministic
(0 → single-block validation only).

## Fix status (batch validation)
Applied with the 36 sibling fix.diffs of this batch in findings/poc/_batch41/all_fixes.patch; single in-guest `make -j6 nativekernel KERNCONF=X86_64_GENERIC` completed RC=0 with zero errors under -Werror (full log: findings/poc/_batch41/fix_build8.log). Behavior A/B intentionally skipped for this Info-tier item.