DF-4431 / verdict.json
{ "finding_id": "DF-4431", "poc_id": "DF-4431", "status": "untested", "reproduced": 0, "impact": "Misprogrammed DCSURF_ADDR_CONFIG (fields set to max) -> display-pipe hang on DCN1 hw with zeroed/garbage GB_ADDR_CONFIG readback", "confidence": "likely", "attempts": 0, "guest_uname": null, "code_hash": null, "exploit_chain": [], "evidence": "Low/hardening; values kernel-read from GPU not userspace-set; trigger is device fault/reset class. Clamp-before-REG_UPDATE fix in finding markdown.", "kernel_refs": [ "sys/dev/drm/amd/display/dc/dcn10/dcn10_hubp.c:133", "sys/dev/drm/amd/display/dc/dcn10/dcn10_hubp.c:141", "sys/dev/drm/amd/display/dc/dcn10/dcn10_hubp.c:146" ], "verdict": "not_run: DCN1 GPU absent from guest (bochs only); arithmetic source-proven (ilog2(0)=fls(0)-1=-1 -> masked field max)", "fix_status": "not_testable", "fix_baseline_reproduced": 0, "fix_patched_reproduced": 0, "fix_verdict": "not_testable: hardware-gated", "fix_evidence": "fix.diff in finding markdown" } |