# VERDICT — DF-4216

**status: untested (hardware-gated) · impact: NULL/wild deref panic on DDC access; wrong-connector I2C routing · confidence: certain (source) / likely (trigger)**

No AMD GPU on the audit guest (`env.txt`), so `dc_submit_i2c` cannot run.

Source proof:
- `dc.c:1742` `dc->links[link_index]` with no comparison against
  `dc->link_count`; array size is 12 (`dc.h:287` `links[MAX_PIPES*2]`,
  MAX_PIPES=6, `hw_shared.h:37`), kzalloc'd so unused slots are NULL.
- Caller `amdgpu_dm.c:4008-4010` passes `ddc_pin->hw_info.ddc_channel`,
  assigned from `i2c_info.i2c_line` (`dc_link_ddc.c:269`) — `enum
  gpio_ddc_line` (`gpio_types.h:206-220`), including `UNKNOWN = -1` and
  values up to 7 — an unrelated index domain (DDC line ≠ link index).
- Outcomes: `-1` → far OOB pointer read then deref; line ≥ link_count →
  NULL->ddc panic (dc.c:1743); mismatched but non-NULL → silent
  wrong-connector DDC routing.
- Confirms upstream divergence: Linux amdgpu_dm later switched to
  `ddc_service->link->link_index` in `amdgpu_dm_i2c_xfer()`; this tree kept
  the pre-fix form.

Low severity (board/VBIOS-dependent), high code certainty. In-file defensive
fix + recommended caller fix documented; not runtime-validated (no hardware)
→ `fix_status: not_testable`.

## Fix status (batch validation)
Applied with the 36 sibling fix.diffs of this batch in findings/poc/_batch41/all_fixes.patch; single in-guest `make -j6 nativekernel KERNCONF=X86_64_GENERIC` completed RC=0 with zero errors under -Werror (full log: findings/poc/_batch41/fix_build8.log). Behavior A/B intentionally skipped for this Info-tier item.