# DF-4226 — VERDICT

**Status: untested — hardware-gated (requires ATI r100–r500 GPU; the QEMU
guest has Bochs VGA `0x1234:1111`, no `/dev/dri`, and radeon.ko cannot
attach).** Source-level certainty is complete; no runtime behavior needs to
be observed to establish the defect.

## Why this is certain from source alone

- The helper contract is symmetric: `prepare()` calls
  `radeon_{atom,combios}_output_lock(encoder, true)` to lock the output
  during reprogramming (radeon_legacy_encoders.c:762/764 for tmds_int,
  1133/1135 for tv_dac); `commit()` must call the same function with
  `false` to release the lock. Three of five legacy encoders in this very
  file do exactly that (lvds: 168-171, primary_dac: 577-580,
  tmds_ext: 939-942).
- `radeon_legacy_tmds_int_commit()` (768-778) and
  `radeon_legacy_tv_dac_commit()` (1139-1149) instead call the lock function
  with `true` — a copy-paste of the prepare() side. The output PLL lock bit
  stays asserted after the modeset completes.
- Upstream Linux drivers/gpu/drm/radeon/radeon_legacy_encoders.c passes
  `false` in both commit functions; the DragonFly tree diverges.

## Impact

Functional display DoS on affected hardware after a DVI/TV modeset (output
stays locked; later DPMS/modeset register updates via the BIOS command
processor fail). Triggering requires DRM master (modeset). **No memory
corruption, no info leak** — register-bit-only defect, hence Low.

## Fix

fix.diff flips the four `true` arguments to `false` (lines 775, 777, 1146,
1148). Fix boot validation is not testable on this guest (no radeon GPU);
the change restores exact parity with the three correct sibling functions.

## Fix status (batch validation)
Applied with the 36 sibling fix.diffs of this batch in findings/poc/_batch41/all_fixes.patch; single in-guest `make -j6 nativekernel KERNCONF=X86_64_GENERIC` completed RC=0 with zero errors under -Werror (full log: findings/poc/_batch41/fix_build8.log). Behavior A/B intentionally skipped for this Info-tier item.