{
 "finding_id": "DF-4216",
 "status": "untested",
 "reproduced": 0,
 "impact": "none",
 "confidence": "certain",
 "verdict": "dc_submit_i2c (dc.c:1742) indexes dc->links[link_index] with no validation against dc->link_count, and the only caller (amdgpu_dm.c:4008-4010) passes ddc_pin->hw_info.ddc_channel \u2014 a gpio_ddc_line DDC line number (gpio_types.h:206-220, UNKNOWN=-1..7) from the VBIOS object table, not a link index. -1 gives a far-OOB pointer read then deref; line>=link_count gives NULL->ddc panic on the first DDC/EDID transaction; otherwise DDC traffic is silently routed to the wrong connector. Upstream Linux fixed the caller to pass ddc_service->link->link_index.",
 "exploit_chain": "",
 "evidence": "findings/poc/DF-4216/VERDICT.md, findings/poc/DF-4216/env.txt (guest pciconf: no triggering hardware), findings/poc/DF-4216/fix.diff",
 "kernel_refs": [
  "sys/dev/drm/amd/display/dc/core/dc.c:1742",
  "sys/dev/drm/amd/display/dc/core/dc.c:1743",
  "sys/dev/drm/amd/display/amdgpu_dm/amdgpu_dm.c:4008",
  "sys/dev/drm/amd/display/dc/core/dc_link_ddc.c:269",
  "sys/dev/drm/amd/display/include/gpio_types.h:206",
  "sys/dev/drm/amd/display/dc/dc.h:287"
 ],
 "poc_changes": "no runnable PoC: hardware-gated path absent from the audit guest (env.txt)",
 "attempts": 0,
 "guest_uname": "DragonFly dfbsd 6.5-DEVELOPMENT #0: Thu Jul  2 06:02:54 UTC 2026 root@dfbsd:/usr/obj/usr/src/sys/X86_64_GENERIC x86_64",
 "runtime_sec": 0,
 "guest_dirty": 0,
 "build_cmd": null,
 "run_cmd": null,
 "code_hash": null,
 "notes": "In-file defensive bounds check + recommended caller fix (link->link_index) for the upstream report.",
 "recommended_fix": "bounds-check link_index in dc_submit_i2c and pass ddc_service->link->link_index from amdgpu_dm",
 "fix_status": "not_testable",
 "fix_baseline_reproduced": 0,
 "fix_patched_reproduced": 0,
 "fix_verdict": "diff authored and git-apply-verified against the read-only sys/ tree; runtime fix validation impossible without the triggering hardware on the QEMU guest",
 "fix_evidence": "findings/poc/DF-4216/fix.diff (git apply --check passed)"
}