VERDICT — DF-4312 dcn10_link_encoder_create unvalidated VBIOS-derived indices
============================================================================

STATUS: inconclusive (code-certain defect; trigger hardware-gated, absent
        from the audit guest)
REPRODUCED: 0 (no AMD GPU in guest; dcn10 pool construction requires
        amdgpu attach to a DCN1/Raven ASIC)

ANALYSIS CONFIRMATION (static, line-accurate):

1. dcn10_resource.c:744-746 - the three table index expressions, arrays
   sized 4 (dcn10_resource.c:309-314 link_enc_regs, 284-289
   link_enc_aux_regs, 296-301 link_enc_hpd_regs). No bounds checks exist
   anywhere between dc_link.c filling enc_init_data and these lookups.

2. dc_link.c:1176-1184 fills the struct:
     enc_init_data.channel = get_ddc_line(link);
     enc_init_data.hpd_source = get_hpd_line(link);
     enc_init_data.transmitter = translate_encoder_to_transmitter(enc_init_data.encoder);
   with bp_funcs->get_src_obj() (atombios parser) supplying the encoder
   object - i.e. all three originate in the GPU VBIOS.

3. Enum domains (grph_object_defs.h:81-92, :58-68, :45-54; dc_link.c
   translate_encoder_to_transmitter/get_ddc_line/get_hpd_line bodies):
   transmitter can be -1 (UNKNOWN) or 4..9 (UNIPHY_E/F, NUTMEG_CRT,
   TRAVIS_CRT/LCD, UNIPHY_G); channel 0 (UNKNOWN) or 5..8 (DDC5/6/VGA/
   I2C_PAD -> idx 4..7); hpd_source 4..6 (HPD5/6, HPD_SOURCEID_UNKNOWN=6).
   Every one of those values indexes outside the 4-entry tables.

4. The resulting out-of-bounds `const struct ..._registers *` is stored
   in the constructed encoder (dcn10_link_encoder_construct) and used as
   the base for all later REG_* MMIO in dcn10_link_encoder.c /
   dcn10_stream_encoder.c - i.e. wild MMIO at VBIOS-chosen offsets, not
   a userspace-readable leak.

Why Low: attacker must control GPU firmware (same boundary as DF-4216,
rated Low). No unprivileged or remote path exists.

Why not guest-testable: guest has no AMD PCI device at all (env.txt);
amdgpu.ko never probes; dcn10_create_resource_pool is unreachable.

Fix: one bounds check in dcn10_link_encoder_create returning NULL on
out-of-range indices (fix.diff; `git apply --check` clean against
sys/; ARRAY_SIZE already used in this compilation unit's sibling
dcn10_stream_encoder.c). The NULL return is already handled gracefully
by dc_link.c:1186-1190 (link_enc_create_fail path).

## Fix status (batch validation)
Applied with the 36 sibling fix.diffs of this batch in findings/poc/_batch41/all_fixes.patch; single in-guest `make -j6 nativekernel KERNCONF=X86_64_GENERIC` completed RC=0 with zero errors under -Werror (full log: findings/poc/_batch41/fix_build8.log). Behavior A/B intentionally skipped for this Info-tier item.