{
  "finding_id": "DF-4446",
  "status": "untested",
  "reproduced": 0,
  "impact": "none",
  "confidence": "certain",
  "verdict": "Static proof certain: DFs i2c_bit_add_bus (sys/dev/drm/linux_i2c.c:127-134) installs a stub algorithm whose master_xfer returns 0 without touching hardware (linux_i2c.c:106-111), so radeon_i2c_create()s bit-bus branch (radeon_i2c.c:955-978) leaves pre_xfer..set_data (radeon_i2c.c:90-232) as dead code and every DDC/EDID transfer on a bit path succeeds with 0 messages \u2014 display detection silently dead for all default-config radeon DDC buses on DragonFly. Info severity (functional port defect, no memory safety, no attacker primitive); runtime verification skipped per contract and hardware-gated anyway (guest has virtio-gpu only).",
  "exploit_chain": "",
  "evidence": "VERDICT.md (line-cited: shim stub vs radeon bit-bus branch); README.md",
  "kernel_refs": [
    "sys/dev/drm/linux_i2c.c:106-111",
    "sys/dev/drm/linux_i2c.c:127-134",
    "sys/dev/drm/radeon/radeon_i2c.c:90-232",
    "sys/dev/drm/radeon/radeon_i2c.c:933-978",
    "sys/dev/drm/drm_edid.c:1513-1558",
    "sys/dev/drm/include/linux/i2c-algo-bit.h:47-58"
  ],
  "poc_changes": "n/a (static finding)",
  "attempts": 0,
  "guest_uname": "DragonFly dfbsd 6.5-DEVELOPMENT #0: Thu Jul  2 06:02:54 UTC 2026 x86_64",
  "runtime_sec": 0,
  "guest_dirty": 0,
  "build_cmd": "",
  "run_cmd": "",
  "code_hash": "",
  "notes": "Info severity => skipped by contract. Also documents the latent DF-only i2c_add_adapter-after-failed-bit_add_bus UAF pattern at radeon_i2c.c:970-973 (unreachable today: shim cannot fail).",
  "recommended_fix": "Implement real bit_xfer in sys/dev/drm/linux_i2c.c using the i2c_algo_bit_data callbacks (port Linux i2c-algo-bit.c)",
  "fix_status": "not_testable",
  "fix_baseline_reproduced": 0,
  "fix_patched_reproduced": 0,
  "fix_verdict": "not_testable (Info functional finding; no hw)",
  "fix_evidence": "VERDICT.md"
}