# DF-4445 evidence pack

- **What**: `radeon_router_select_ddc_port()` / `radeon_router_select_cd_port()`
  use `u8 val;` uninitialized (`sys/dev/drm/radeon/radeon_i2c.c:1108-1133`,
  `:1136-1161`). `radeon_i2c_get_byte()` only writes `*val` when the i2c
  transfer succeeds (`radeon_i2c.c:1077-1083`); on failure the caller's `val`
  keeps its garbage stack contents and is then unconditionally
  masked/OR-ed and **written back to the router's i2c config registers**
  (0x3 / 0x1) — garbage in every bit outside `ddc_mux_control_pin`.
  The failure branch of `radeon_i2c_get_byte()` also `DRM_DEBUG`-prints the
  uninitialized byte. Upstream Linux has the same defect (inherited).
- **Severity**: Low (needs a router-equipped connector + failing router
  read; consequence is wrong mux configuration / display misrouting and a
  debug-log stack-byte leak). Verification skipped per audit contract for
  Low findings; no radeon hardware on the audit guest anyway (virtio-gpu
  only).
- **Fix**: initialize `u8 val = 0;` in both functions (or bail out when
  `radeon_i2c_get_byte` failed — it would need a return value for that;
  minimal safe fix is the zero-init).

## Reproduce (on radeon hardware)

```
cc -O2 -o /tmp/df4445 df4445_probe.c && /tmp/df4445   # optional helper
```
The defect itself is visible only with `drm.debug=0x02` while a DDC
probe runs on a connector whose router read NAKs (broken/unplugged
mux chip): dmesg shows `i2c 0x.. 0x<garbage> read failed` with a
changing garbage byte derived from prior stack contents.

## Files
- `VERDICT.md` — static line-cited analysis
- `df4445_probe.c` — optional compiled-but-inert demonstration stub
- `fix.diff` — two-line zero-init fix
- `verdict.json` (status `untested`), `manifest.json`