# DF-4352 VERDICT

**Status: untested (kernel path) — code defect certain; guest model
enumerates every reachable OOB index.**

## Root cause (line-accurate)
dce110_link_encoder_create (sys/dev/drm/amd/display/dc/dce110/
dce110_resource.c:576-592):

```
588:  &link_enc_regs[enc_init_data->transmitter],      /* 7 entries :259-267 */
589:  &link_enc_aux_regs[enc_init_data->channel - 1],  /* 6 entries :230-237 */
590:  &link_enc_hpd_regs[enc_init_data->hpd_source]    /* 6 entries :244-251 */
```

The three indices are VBIOS-derived, filled in dc_link.c at link
construct:

- transmitter — translate_encoder_to_transmitter (dc_link.c:1006-1024+)
  returns TRANSMITTER_UNKNOWN (**-1**) for unrecognized encoder ids, and
  external/NUTMEG/TRAvis encoders and UNIPHY_G map to **6..9**
  (grph_object_defs.h:81-94).  Table domain: 0..6.
- channel — get_ddc_line (dc_link.c:964-1004) returns
  CHANNEL_ID_UNKNOWN (**0**) by default, CHANNEL_ID_DDC_VGA (**7**) and
  CHANNEL_ID_I2C_PAD (**8**) explicitly.  With the `- 1` shift at :589
  the reachable indices are **-1, 6, 7** against a 6-entry table
  (grph_object_defs.h:58-69).
- hpd_source — get_hpd_line (dc_link.c:925-962) returns
  HPD_SOURCEID_UNKNOWN (**7**) when no HPD gpio exists; COUNT=6.
  Both are OOB against the 6-entry table (grph_object_defs.h:45-55).

None of the three is validated anywhere on the path.  The OOB read
produces a `struct dce110_link_enc_registers`-shaped blob of adjacent
.rodata which dce110_link_encoder_construct stores; every subsequent
register access on that encoder dereferences offsets from it as MMIO
addresses — VBIOS-chosen wild MMIO (bring-up hang / machine check at
minimum, wrong-hardware register pokes at worst).  No userspace-readable
leak.

Twin of DF-4312 (dcn10, 4-entry tables) and DF-4319 (dce80) — same
family, different file, different table sizes and a -1 shift unique to
the channel lookup.

## Verification
- Kernel path untestable on the audit guest: pciconf (root) lists only
  i440FX/PIIX + virtio devices — no AMD GPU, amdgpu unbindable (env.txt).
- Guest model `df4352.c` (cc 8.3; build.log/run.log) replicates the
  three tables (7/6/6) and the three verbatim index expressions over
  the real enum domains: 9 of 28 reachable values index OOB, including
  -1 twice.

## Fix validation
Kernel-level validation impossible on this guest.  fix.diff (git apply
--check clean) bounds-checks all three values and returns NULL; the
caller dc_link.c:1187-1190 already handles NULL by failing this link's
creation cleanly (link_enc_create_fail).

## Fix status (batch validation)
Applied with the 36 sibling fix.diffs of this batch in findings/poc/_batch41/all_fixes.patch; single in-guest `make -j6 nativekernel KERNCONF=X86_64_GENERIC` completed RC=0 with zero errors under -Werror (full log: findings/poc/_batch41/fix_build8.log). Behavior A/B intentionally skipped for this Info-tier item.