{
  "finding_id": "DF-4205",
  "status": "untested",
  "reproduced": 0,
  "impact": "none",
  "confidence": "certain",
  "verdict": "Bug existence certain from source trace: vlv_dsi_init dereferences vbt.dsi.config (vlv_dsi.c:1797 ->dual_link, :1826 ->pwm_blc) with no NULL guard, while the pointer is only populated when BDB_MIPI_CONFIG exists and both kmemdups in parse_mipi_config succeed (intel_bios.c:826-856); presence is decided by the separate child-device list (intel_bios.c:2034-2047). Missing section or config-kmemdup OOM => NULL-page panic at attach; pps-kmemdup OOM => dangling config (kfree without NULL, intel_bios.c:848-851) => UAF read of freed struct. Not verified on the guest: no Intel GPU on the audit VM and the trigger is VBT-firmware/OOM-gated, so Phase V is skipped per contract (Low severity). Impact ceiling is a boot/attach panic or a bounded UAF read of driver memory; no userland-reachable write primitive.",
  "exploit_chain": "",
  "evidence": "README.md and VERDICT.md in this pack; decisive lines: vlv_dsi.c:1747 (presence check), vlv_dsi.c:1797+1826 (unguarded deref), intel_bios.c:826-830 (config left NULL), intel_bios.c:848-851 (kfree without NULL), intel_bios.c:2034-2047 (decoupled presence signal), intel_dsi_vbt.c:506+523-544 (later full parse of the same pointer).",
  "kernel_refs": [
    "sys/dev/drm/i915/vlv_dsi.c:1797",
    "sys/dev/drm/i915/vlv_dsi.c:1826",
    "sys/dev/drm/i915/intel_bios.c:826",
    "sys/dev/drm/i915/intel_bios.c:848",
    "sys/dev/drm/i915/intel_bios.c:2027",
    "sys/dev/drm/i915/intel_dsi_vbt.c:506"
  ],
  "poc_changes": "No PoC authored: trigger requires a VBT with MIPI child device but no BDB_MIPI_CONFIG block (or a forced kmemdup failure) on real hardware; the audit guest has no Intel GPU. Static proof of path only.",
  "attempts": 0,
  "guest_uname": null,
  "runtime_sec": 0,
  "guest_dirty": 0,
  "build_cmd": null,
  "run_cmd": null,
  "code_hash": null,
  "notes": "Pass-2 finding, distinct from DF-1390 (OOB indexing inside parse_mipi_config) and DF-1773 (NULL lfp_lvds_vbt_mode in intel_dsi_vbt_init, which is never reached because vlv_dsi.c:1797 faults first). Mirrors upstream Linux vlv_dsi_init of the same vintage (upstream also lacks the guard).",
  "recommended_fix": "Bail to the pre-connector err label when vbt.dsi.config is NULL in vlv_dsi_init, and NULL the pointer after the pps-failure kfree in parse_mipi_config (fix.diff).",
  "fix_status": "not_applicable",
  "fix_baseline_reproduced": 0,
  "fix_patched_reproduced": 0,
  "fix_verdict": "No kernel-build fix validation performed: Low-severity firmware/OOM-gated finding, guest lacks Intel GPU; the two-hunk guard in fix.diff is trivially auditable by inspection.",
  "fix_evidence": "fix.diff (consumer guard + producer NULL-out); not built or applied to sys/."
}