{
  "finding_id": "DF-4198",
  "status": "inconclusive",
  "reproduced": 0,
  "impact": "dos",
  "confidence": "certain",
  "verdict": "Hardware-gated (guest has no AMD/DCN GPU) AND currently mapping-gated (the sole caller, calcs/dcn_calcs.c:353-377, maps every non-420/64bpp UABI format to dm_444_32 and never emits dm_444_8), so the in-kernel panic is not reachable today \u2014 but the arithmetic defect is certain and was proven EXACTLY on the DragonFly guest by compiling the REAL, unmodified dml1_display_rq_dlg_calc.c (plus real dcn_calc_math.c/dml_common_defs.c/DML headers from the guests /usr/src, only dm_services.h stubbed to release-build WARN_ON semantics) and driving it with a realistic DCN1 config: source_format=dm_444_8 (the enum value aliased dm_mono_8, display_mode_enums.h:42-43) plus dm_sw_linear executes blk256_width = 256 / bytes_per_element at dml1_display_rq_dlg_calc.c:641 with bytes_per_element==0 -> integer division by zero -> SIGFPE (rc=136, 3/3 runs), the userland analog of the kernel #DE panic. Second zero-divisor at :745 is dead code at -O2 (meta_blk_width unused) and dml_log2(0)==-127 (dcn_bw_log bit-trick) silently programs garbage RQ/DLG registers for non-linear unhandled formats (harness mono8: stored_swath=0, nonsense). Patched real file (fix.diff) : all three modes rc=0 with sane 1-byte-per-element values. Same verification convention as the DF-3869 dce_calcs #DE family.",
  "exploit_chain": "",
  "evidence": "run.log baseline mono8_linear Floating point exception rc=136 vs fixed mono8_linear OK: rq_l sw=2304 h=1 ... stored_swath=4608 rc=0; run.2.log 3/3 determinism; run.3.log end-to-end pack run (build.sh+run.sh) against the guests /usr/src",
  "kernel_refs": [
    "sys/dev/drm/amd/display/dc/dml/dml1_display_rq_dlg_calc.c:40",
    "sys/dev/drm/amd/display/dc/dml/dml1_display_rq_dlg_calc.c:641",
    "sys/dev/drm/amd/display/dc/dml/dml1_display_rq_dlg_calc.c:745",
    "sys/dev/drm/amd/display/dc/dml/dml1_display_rq_dlg_calc.c:636",
    "sys/dev/drm/amd/display/dc/dml/display_mode_enums.h:42",
    "sys/dev/drm/amd/display/dc/calcs/dcn_calc_math.c:112",
    "sys/dev/drm/amd/display/dc/calcs/dcn_calcs.c:353",
    "sys/dev/drm/amd/display/dc/calcs/dcn_calcs.c:487",
    "sys/dev/drm/amd/display/dc/os_types.h:76"
  ],
  "poc_changes": "harness written fresh (no seed): REAL kernel sources compiled unmodified; dm_services.h stub supplies DC_LOG_DML no-op and non-fatal ASSERT (os_types.h:76 release semantics: WARN_ON); DCN1-realistic ip/soc params (det_buffer 164KB, dpte_buffer 64 pte reqs, vmm_page 4096, 1920x1080 viewport)",
  "attempts": 3,
  "guest_uname": "DragonFly dfbsd 6.5-DEVELOPMENT #0: Thu Jul 2 06:02:54 UTC 2026 root@dfbsd:/usr/obj/usr/src/sys/X86_64_GENERIC x86_64",
  "runtime_sec": 20,
  "guest_dirty": 0,
  "build_cmd": "./build.sh  (cc -O2 real dml1_display_rq_dlg_calc.c + dcn_calc_math.c + dml_common_defs.c + dml1_harness.c -lm)",
  "run_cmd": "./run.sh  (baseline normal/mono8/mono8_linear + fixed normal/mono8/mono8_linear)",
  "code_hash": "c6054b20a126334054eeeaa935eae08759cdc299e74cb542c7db5fda1eeaef1c",
  "notes": "Trigger would be: DCN1 modeset validation with a plane whose DML source_format is dm_444_8/dm_mono_8 (or any out-of-set enum) in linear layout. Latent today via dcn_calcs mapping (default->dm_444_32); armed the moment any caller passes dm_mono_8, which the enum defines for exactly that purpose. All double-precision division sites in the file produce inf/NaN->0x80000000 casts, not traps (checked, see VERDICT.md killed negatives); data_pitch (=viewport width, dcn_calcs.c:285) zero-divisor speculative and not filed.",
  "recommended_fix": "Handle dm_444_8 (dm_mono_8) -> 1 byte/element in get_bytes_per_element and bail out of get_surf_rq_param when bytes_per_element==0 (ASSERT is only WARN_ON in release builds; see fix.diff)",
  "fix_status": "inconclusive",
  "fix_baseline_reproduced": 1,
  "fix_patched_reproduced": 0,
  "fix_verdict": "fix.diff applied to the REAL dml1_display_rq_dlg_calc.c and recompiled in the harness: baseline mono8_linear SIGFPE 3/3 vs fixed 0/3 with sane outputs (sw=2304 h=1 dpte_row_h=128); normal-mode outputs byte-identical to baseline. Kernel-level validation not possible on this guest (no AMD GPU to load the amdgpu DC path), so kernel-level fix status stays inconclusive; real-source-level validation passed cleanly.",
  "fix_evidence": "run.log/run.3.log baseline-vs-patched contrast lines; dml1_display_rq_dlg_calc.fixed.c (shipped, = fix.diff applied); fix.diff"
}