{
  "finding_id": "DF-4445",
  "status": "untested",
  "reproduced": 0,
  "impact": "none",
  "confidence": "likely",
  "verdict": "Static trace is complete and certain (see VERDICT.md): radeon_i2c.c:1110/:1138 declare u8 val uninitialized; radeon_i2c_get_byte() only writes it on i2c success (radeon_i2c.c:1077-1083) but the callers unconditionally mask/OR and write the byte back into router config registers 0x3/0x1 (radeon_i2c.c:1121-1132, 1149-1160) and the failure branch DRM_DEBUG-prints the uninitialized byte. Inherited verbatim from upstream Linux (not DF-specific code). Impact ceiling: wrong external-router configuration bits (display misrouting) + one-byte kernel-stack disclosure into debug logs; Low. Verification skipped per audit contract for Low findings; no radeon hardware exists on the audit guest regardless.",
  "exploit_chain": "",
  "evidence": "VERDICT.md line-cited trace; fix.diff (zero-init)",
  "kernel_refs": [
    "sys/dev/drm/radeon/radeon_i2c.c:1108-1133",
    "sys/dev/drm/radeon/radeon_i2c.c:1136-1161",
    "sys/dev/drm/radeon/radeon_i2c.c:1052-1084",
    "sys/dev/drm/radeon/radeon_i2c.c:42-70"
  ],
  "poc_changes": "n/a (static finding; helper stub only)",
  "attempts": 0,
  "guest_uname": "DragonFly dfbsd 6.5-DEVELOPMENT #0: Thu Jul  2 06:02:54 UTC 2026 x86_64",
  "runtime_sec": 0,
  "guest_dirty": 0,
  "build_cmd": "cc -O2 -o /tmp/df4445 df4445_probe.c (helper only)",
  "run_cmd": "/tmp/df4445 (prints static note; not a reproducer)",
  "code_hash": "753e21899bd4b65ca8fe42ea2a72aed4eefe7e1994008b646ac888a88b354357",
  "notes": "Low severity => skipped runtime verification by contract; also hardware-gated (virtio-gpu guest). Upstreamable fix.",
  "recommended_fix": "Initialize u8 val = 0 in radeon_router_select_ddc_port/radeon_router_select_cd_port",
  "fix_status": "not_testable",
  "fix_baseline_reproduced": 0,
  "fix_patched_reproduced": 0,
  "fix_verdict": "not_testable (Low-severity static finding; no radeon hw on guest)",
  "fix_evidence": "fix.diff"
}