{
  "finding_id": "DF-4166",
  "status": "untested",
  "reproduced": 0,
  "impact": "none",
  "confidence": "certain",
  "verdict": "Off-by-one in get_gpio_i2c_info: the guard at bios_parser2.c:369 is `count < table_index`, so table_index == count skips the search loop and gpio_pin[count] is read at :401-405 - one 8-byte entry past the table region declared by structuresize. Distinct root cause from DF-1415 (which is about count exceeding the declared gpio_pin[8]); this triggers even with a perfectly consistent table. Impact is a small OOB read whose bytes become the DDC/GPIO MMIO register index and bitshift.",
  "exploit_chain": "Hardware attacker model only: crafted VBIOS field on AMD hardware. No userland-triggerable chain on the audit guest - path hardware-gated.",
  "evidence": "VERDICT.md (root cause, line-accurate), README.md (trigger math), env.txt (guest hardware-gating proof: pciconf/sysctl/uname), fix.diff (source-authored, git-apply-able, not build-validated).",
  "kernel_refs": [
    "sys/dev/drm/amd/display/dc/bios/bios_parser2.c:367",
    "sys/dev/drm/amd/display/dc/bios/bios_parser2.c:369",
    "sys/dev/drm/amd/display/dc/bios/bios_parser2.c:401",
    "sys/dev/drm/amd/include/atomfirmware.h:597"
  ],
  "poc_changes": "None - no seeded PoC sources existed for these pass-2 findings; packs built fresh.",
  "attempts": 1,
  "guest_uname": "DragonFly dfbsd 6.5-DEVELOPMENT DragonFly 6.5-DEVELOPMENT #0: Thu Jul  2 06:52:54 UTC 2026  root@dfbsd:/usr/obj/usr/src/sys/X86_64_GENERIC x86_64",
  "runtime_sec": 25,
  "guest_dirty": 0,
  "build_cmd": null,
  "run_cmd": null,
  "code_hash": "f39ae275c2f6823f30573aa78a7bd6965b303dd64794234f44f0e140f8c5b185",
  "notes": "Hardware-gated: audit QEMU guest has no AMD GPU (pciconf shows only bochs SVGA 0x1234:1111; sysctl dev.drm unknown; no amdgpu binding - see env.txt). The audited code path (DC bios_parser2 / smu8 powerplay) never executes on this guest; reproduction requires a DCE12-class ASIC / KV-CZ APU with a crafted VBIOS (flashed ROM or vfio romfile override), which is the stated attacker model. poc status untested per persist_poc enum (hardware-gated; equivalent to not_testable). fix.diff authored from line-accurate source confirmation; fix build/validation impossible without the hardware.",
  "recommended_fix": "Change the guard to `count <= table_index` so index==count enters the search loop.",
  "fix_status": "not_testable",
  "fix_baseline_reproduced": 0,
  "fix_patched_reproduced": 0,
  "fix_verdict": "Fix authored from source analysis only: Change the guard to `count <= table_index` so index==count enters the search loop. Baseline/patched kernels could not be exercised on the audit guest (no AMD GPU), so fix validation is not_testable rather than fixed.",
  "fix_evidence": "fix.diff in this pack (unified diff generated against the pristine sys/ tree)."
}