{
  "finding_id": "DF-4105",
  "status": "untested",
  "reproduced": 0,
  "impact": "none",
  "confidence": "certain",
  "verdict": "Source-level certain: the fake-EDID record handler kmalloc()s max(128,len) bytes but memcpy()s only ucFakeEDIDLength of them (atombios_encoders.c:2173-2176); for len<128 the tail is uninitialized heap. drm_edid_is_valid (drm_edid.c:1484-1497) then reads the uninit byte126 (extensions) and walks up to 255 extra 128-byte blocks past the chunk (OOB heap read), and on a ~1/256 checksum pass the tainted 128-byte EDID is cached as bios_hardcoded_edid and copied wholesale to userspace via amdgpu_connector_get_edid (amdgpu_connectors.c:269-274) + GETCONNECTOR ioctl - kernel heap info leak. Distinct from DF-1380 (walk/memcpy source bounds; this is the destinations uninit tail, fixed by kzalloc). Hardware absent on guest.",
  "exploit_chain": "",
  "evidence": "VERDICT.md: the three code excerpts (atombios_encoders.c:2167-2183, drm_edid.c:1484-1497, amdgpu_connectors.c:269-274) and the 1/256 checksum-gate analysis.",
  "kernel_refs": [
    "sys/dev/drm/amd/amdgpu/atombios_encoders.c:2173",
    "sys/dev/drm/amd/amdgpu/atombios_encoders.c:2175",
    "sys/dev/drm/drm_edid.c:1492",
    "sys/dev/drm/amd/amdgpu/amdgpu_connectors.c:269"
  ],
  "poc_changes": "No runnable PoC (hardware absent); pack is the source trace + one-line kzalloc fix.",
  "attempts": 0,
  "guest_uname": "DragonFly dfbsd 6.5-DEVELOPMENT #0: Thu Jul 2 06:02:54 UTC 2026 x86_64 (no AMD GPU)",
  "runtime_sec": 0,
  "guest_dirty": 0,
  "build_cmd": "",
  "run_cmd": "",
  "code_hash": "",
  "notes": "Hardware-gated behind a crafted VBIOS fake-EDID record (same gate/threat model as DF-1380, hence Low). Retries across a single boot do not diversify the tail: the failed chunk is kfreed and the next same-size kmalloc reuses it deterministically.",
  "recommended_fix": "kzalloc instead of kmalloc for the EDID buffer (fix.diff).",
  "fix_status": "not_testable",
  "fix_baseline_reproduced": 0,
  "fix_patched_reproduced": 0,
  "fix_verdict": "One-line kzalloc fix removes both the uninit-tail leak and the uninit extensions-byte walk; not buildable/testable on guest (no AMD GPU).",
  "fix_evidence": "findings/poc/DF-4105/fix.diff"
}