# VERDICT - DF-4384 (Info, not tested live - no AMD hardware on guest)

Class: latent API hazard / hardening (CWE-125 for future callers).
Severity: Info. Confidence: certain (code-provable), impact none today.

* Function: dcn10_link_encoder.c:292-335 (called from
  dcn10_link_encoder_dp_set_phy_pattern, dcn10_link_encoder.c:1099-1102).
* custom_pattern_size exists (stream_encoder.h:75-76) and is ignored.
* Both kernel-side call chains pass fixed 10-byte buffers:
  - dp_test_send_phy_test_pattern(): core_link_read_dpcd of exactly
    DP_TEST_80BIT_CUSTOM_PATTERN_7_0..79_72 (10 bytes) into a local array
    (dc_link_dp.c:1871-1876, 1912-1914);
  - amdgpu_dm debugfs test_pattern write: copies 10 bytes from the user
    token into custom_pattern[10] and passes 10 (amdgpu_dm_debugfs.c:654-666).
* Guest has no AMD GPU (QEMU std VGA); the path cannot execute there.

Not a vulnerability in this tree; filed as Info so the contract violation is
on record (the same pattern exists in dce_link_encoder.c:327).

## Fix status (batch validation)
Applied with the 36 sibling fix.diffs of this batch in findings/poc/_batch41/all_fixes.patch; single in-guest `make -j6 nativekernel KERNCONF=X86_64_GENERIC` completed RC=0 with zero errors under -Werror (full log: findings/poc/_batch41/fix_build8.log). Behavior A/B intentionally skipped for this Info-tier item.

(No fix.diff for this item: documented recommendation only - see Fix above.)