{
  "finding_id": "DF-4319",
  "status": "untested",
  "reproduced": 0,
  "impact": "none",
  "confidence": "likely",
  "verdict": "dce80_link_encoder_create (dce80_resource.c:661-678) indexes three const register tables with unvalidated VBIOS-derived enum values: &link_enc_regs[transmitter] (7 entries) accepts TRANSMITTER_UNKNOWN=-1 (default arm of translate_encoder_to_transmitter, dc_link.c:1006-1069) and TRAVIS_CRT=7/TRAVIS_LCD=8/UNIPHY_G=9; &link_enc_aux_regs[channel-1] (6 entries) accepts channel=CHANNEL_ID_UNKNOWN(0)\u2192-1, DDC_VGA(7)\u21926, I2C_PAD(8)\u21927 (get_ddc_line, dc_link.c:964-1004); &link_enc_hpd_regs[hpd_source] (6 entries) accepts HPD_SOURCEID_UNKNOWN=6 (get_hpd_line default, dc_link.c:925-962). The stored OOB pointers are dereferenced on live paths (AUX_REG at dce_link_encoder.c:494,501; HPD_REG at :1370,1384 \u2192 dm_read_reg/dm_write_reg), programming register addresses read from adjacent static data. Same defect family as DF-4312 (dcn10). Kernel-path reproduction untested: guest has no AMD GPU and the indices originate in the GPU ROM, so no local user can influence them; exploitation requires crafted VBIOS (physical access). Index-reachability proof built and run on the guest (run.log) \u2014 the code-level defect is certain, exploitation hardware-gated, hence Low/likely.",
  "exploit_chain": "Physical/VBIOS-gated: flash crafted VBIOS with encoder object (e.g. EXTERNAL_TRAVIS enum_id=2 \u2192 transmitter=8) or connector without HPD GPIO (hpd_source=UNKNOWN=6) on a Sea Islands dGPU \u2192 OOB regs pointer into adjacent .data at link creation \u2192 dm_write_reg at semi-chosen offsets during encoder setup/HPD handling \u2192 display-engine misprogramming or hang (corruption ceiling with fully chosen adjacent data). No unprivileged route: values never traverse userspace.",
  "evidence": "run.log (guest-built index matrix: -1/7/8/9 vs 7; -1/6/7 vs 6; 6 vs 6, all marked OUT OF BOUNDS); enum defs include/grph_object_defs.h:45-94; provenance dc_link.c:925-1069; deref sites dce_link_encoder.c:494,501,1370,1384; env.txt (no AMD GPU on guest)",
  "kernel_refs": [
    "sys/dev/drm/amd/display/dc/dce80/dce80_resource.c:661",
    "sys/dev/drm/amd/display/dc/core/dc_link.c:1006",
    "sys/dev/drm/amd/display/dc/core/dc_link.c:964",
    "sys/dev/drm/amd/display/dc/core/dc_link.c:925",
    "sys/dev/drm/amd/display/dc/dce/dce_link_encoder.c:494",
    "sys/dev/drm/amd/display/dc/dce/dce_link_encoder.c:1370",
    "sys/dev/drm/amd/display/include/grph_object_defs.h:81"
  ],
  "poc_changes": "No seed PoC (pass-2 checklist applying DF-4312s family to dce80). Authored df4319.c reachability proof with enum values transcribed from grph_object_defs.h and table sizes from dce80_resource.c; fixed an enumerator-name collision (HPD_SOURCEID6) found during the first guest build.",
  "attempts": 1,
  "guest_uname": "DragonFly dfbsd 6.5-DEVELOPMENT DragonFly 6.5-DEVELOPMENT #0: Thu Jul  2 06:02:54 UTC 2026     root@dfbsd:/usr/obj/usr/src/sys/X86_64_GENERIC  x86_64",
  "runtime_sec": 60,
  "guest_dirty": 0,
  "build_cmd": "cc -O2 -Wall -o df4319 df4319.c",
  "run_cmd": "./df4319",
  "code_hash": "613e1e15d24bed17aef3413047c53858e1a7d10b676ec336ecce96ab3fe83bd9",
  "notes": "Severity calibrated to DF-4312 (Low, AV:P, kernleak-adjacent family). The aux index 6 case (DDC_VGA) is reachable with a WELL-FORMED VBIOS on boards exposing analog VGA via a DDC_VGA line, though such encoders never program DP AUX registers in practice; the -1 and hpd=6 cases need unknown encoder/HPD objects (malformed ROM).",
  "recommended_fix": "Bounds-validate transmitter/channel/hpd_source against the three table ranges in dce80_link_encoder_create before forming the pointers; free enc110 and return NULL on violation (caller already handles NULL).",
  "fix_status": "not_testable",
  "fix_baseline_reproduced": 0,
  "fix_patched_reproduced": 0,
  "fix_verdict": "fix.diff adds range checks (transmitter\u2208[UNIPHY_A,NUTMEG_CRT], channel\u2208[DDC1,DDC6], hpd\u2208[SOURCEID1,SOURCEID6]) with kfree(enc110)+NULL return; caller dc_link.c:1187-1189 fails link construction gracefully. Not kernel-testable: guest has no AMD GPU and the trigger values require a crafted VBIOS.",
  "fix_evidence": "fix.diff; reachability matrix in run.log showing exactly the enum values the new guards reject"
}