# DF-4449 — dce120 `audio_regs[]` has 6 entries but `res_cap.num_audio = 7` (latent OOB; upstream fix 44035ec2fde1 missing)

**File:** `sys/dev/drm/amd/display/dc/dce120/dce120_resource.c`
**Severity:** Info (latent hardening / upstream-divergence tracking) · **CWE:** CWE-129

## Facts

* `audio_regs[]` defines entries 0..5 only (`dce120_resource.c:322-329`).
* `res_cap.num_audio = 7` (`:438-444`).
* `create_audio(ctx, inst)` passes `&audio_regs[inst]` straight into
  `dce_audio_create` (`:605-610`), which stores the pointer as the endpoint's
  register table.

## Upstream history (the reason this matters)

Upstream Linux hit exactly this mismatch and fixed it in
**commit `44035ec2fde1` "drm/amd/dc/dce120: Fix audio register mapping, stop
triggering KASAN" (Lyude Paul, 2022-11-23, Cc: stable)**:

> `BUG: KASAN: global-out-of-bounds in read_indirect_azalia_reg`
> "on my dce120 GPU there are supposedly 7 sets of audio registers. But we
> only define a register mapping for 6 sets."

The upstream fix adds `audio_regs(6)` (verified present in v6.6; absent in
v4.19..v5.10 — the bug became *reachable* upstream when `resource.c` dropped
the `pipe_count` cap on the audio-creation loop).

## Why DF is latent (not reachable today)

The DF `resource_construct` caps the audio-creation loop at pipe count:

* `sys/dev/drm/amd/display/dc/core/dc_resource.c:232`:
  `for (i = 0; i < pool->pipe_count && i < num_audio; i++)`

`pipe_count` is 6 (or fewer with Vega20 harvesting), so `create_audio` is
only ever called with inst 0..5 — `audio_regs[6]` is never formed in this
tree. **No runtime OOB today.** The mismatch becomes a live
`global-out-of-bounds` (KASAN-proven class) the moment dc_resource.c is
synced to the modern upstream loop (`i < num_audio` uncapped), which is
precisely how upstream got bitten.

## Recommended fix

Apply the upstream fix verbatim (one line, also removes the mismatch even
while latent):

```diff
 	audio_regs(4),
-	audio_regs(5)
+	audio_regs(5),
+	audio_regs(6)
 };
```

## Fix status (batch validation)
Applied with the 36 sibling fix.diffs of this batch in findings/poc/_batch41/all_fixes.patch; single in-guest `make -j6 nativekernel KERNCONF=X86_64_GENERIC` completed RC=0 with zero errors under -Werror (full log: findings/poc/_batch41/fix_build8.log). Behavior A/B intentionally skipped for this Info-tier item.