{
  "finding_id": "DF-4199",
  "status": "reproduced",
  "reproduced": 1,
  "impact": "none",
  "confidence": "certain",
  "verdict": "REAL dcn_calc_auto.c + dcn_calc_math.c compiled unmodified on the audit guest and driven exactly like the kernel (memset-0 vars + DCN1 socbb/ip defaults + kernel call sequence): two byte-identical planes differing only in dcc_enable produce byte-identical read_bandwidth, proving the four overhead factors (1 + 1/256)/:(1 + 1/64)/:(1 + 1/512) at dcn_calc_auto.c:178/181/184/187 are C integer constant divisions that compile to *1 \u2014 the DCC/PTE bandwidth overhead accounting is dead code. Same harness proves the pass-2 negative results: no integer #DE sites exist (all-float arithmetic; zero clocks/pixel_clock/htotal/viewport yield inf/NaN that fail validation safe, voltage_level stays in [0,5]). Info severity: worst realistic impact is marginal DCN1 modes passing validation and hitting display underruns; identical transcription bug exists upstream.",
  "exploit_chain": "",
  "evidence": "run.log/run.2.log baseline DEFECT PRESENT ... ratio=1.000000000 vs fixed FIXED ... ratio=1.003906250; degen sections show no SIGFPE for zero clocks and safe voltage_level=5; log0 section documents dcn_bw_log(0)=-127 no-trap twin; build.log real-source compile; env.txt guest uname + no AMD GPU",
  "kernel_refs": [
    "sys/dev/drm/amd/display/dc/calcs/dcn_calc_auto.c:178",
    "sys/dev/drm/amd/display/dc/calcs/dcn_calc_auto.c:181",
    "sys/dev/drm/amd/display/dc/calcs/dcn_calc_auto.c:184",
    "sys/dev/drm/amd/display/dc/calcs/dcn_calc_auto.c:187",
    "sys/dev/drm/amd/display/dc/calcs/dcn_calc_auto.c:189",
    "sys/dev/drm/amd/display/dc/calcs/dcn_calc_auto.c:231",
    "sys/dev/drm/amd/display/dc/calcs/dcn_calcs.c:716",
    "sys/dev/drm/amd/display/dc/calcs/dcn_calcs.c:57"
  ],
  "poc_changes": "harness written fresh (no seed): kernel-faithful fill of struct dcn_bw_internal_vars (memset-0 + dcn10_soc/ip_defaults transcribed from dcn_calcs.c:57-157 + per-state tables dcn_calcs.c:796-831); dm_services.h stub extended with u64/BUILD_BUG_ON/div64_u64_rem for the real bw_fixed.h inlines; display_clock.h stub = opaque struct dc_clocks",
  "attempts": 3,
  "guest_uname": "DragonFly dfbsd 6.5-DEVELOPMENT DragonFly 6.5-DEVELOPMENT #0: Thu Jul  2 06:02:54 UTC 2026     root@dfbsd:/usr/obj/usr/src/sys/X86_64_GENERIC  x86_64",
  "runtime_sec": 25,
  "guest_dirty": 0,
  "build_cmd": "./build.sh  (cc -O2 real dcn_calc_auto.c + dcn_calc_math.c + dcnauto_harness.c -lm, baseline + fix.diff-patched)",
  "run_cmd": "./run.sh   (dcc baseline+fixed, pte, degen, log0)",
  "code_hash": "05898b18053372cd669397a475ed9a21d99048af1b28f9519cdb57d958d7a45b",
  "notes": "Pass-2 killed with evidence: (a) no integer/float->int division or cast traps exist in the file (all float; voltage_level in [0,5] proven by memset-0 voltage_override_level + i=5 first-assignment); (b) dcn_bw_log(0)=-127 garbage no-trap twin unreachable from validated planes; (c) all array writes bounded (pipe_count<=6 = plane array size, i<=5 into [6], j<=1 into [2], dispclk_dppclk_ratio in {1,2}); (e) byte_per_pixel else-branch covers all enums (no zero divisor). Same bug present in upstream Linux REVISION#250 file.",
  "recommended_fix": "Replace the four integer-constant factors with float constants: (1.0 + 1.0/256.0), (1.0 + 1.0/64.0), (1.0 + 1.0/256.0), (1.0 + 1.0/512.0) \u2014 see fix.diff.",
  "fix_status": "fixed",
  "fix_baseline_reproduced": 1,
  "fix_patched_reproduced": 0,
  "fix_verdict": "fix.diff applied to the REAL dcn_calc_auto.c and recompiled on the guest: baseline defect 2/2 runs (ratio exactly 1.000000000), patched 0/2 with DCC plane exactly 1.00390625x the non-DCC plane. Harness-level validation complete; kernel-build validation not possible (guest has no AMD GPU).",
  "fix_evidence": "run.log + run.2.log baseline DEFECT PRESENT; run.3.log fixed FIXED: factor is (1.0 + 1.0/256.0) = 1.00390625; fix.diff"
}