{
  "finding_id": "DF-4450",
  "status": "inconclusive",
  "reproduced": 0,
  "impact": "none",
  "confidence": "certain",
  "verdict": "Arithmetic defect proven (demo compiled and run on the DF 6.5 guest): a sink reporting DP_SYNCHRONIZATION_LATENCY_IN_SINK=0xF makes hsw_activate_psr2() compute 15+1=16, overflowing the 4-bit EDP_PSR2_IDLE_FRAME and EDP_PSR2_FRAME_BEFORE_SU fields of EDP_PSR2_CTL and corrupting TP2_TIME as well (0xc0000310 -> IDLE_FRAME=0, FRAME_BEFORE_SU=1, TP2_TIME=50us). Kernel-side MMIO manifestation is hardware-bound and cannot be exercised: the guest has virtio-gpu only, i915 cannot bind. Impact ceiling is display-timing corruption on PSR2-capable platforms (local DoS via crafted sink); no kernel memory-safety effect. Mapped to inconclusive (device absent) per orchestrator enum.",
  "exploit_chain": "",
  "evidence": "run.log: latency=15 (SPILLS!) EDP_PSR2_CTL=0xc0000310 -> IDLE_FRAME=0 FRAME_BEFORE_SU=1 TP2_TIME=50us vs legal max latency=14 -> 0xc00002ff IDLE_FRAME=15 FRAME_BEFORE_SU=15 TP2_TIME=2500us; env.txt proves virtio-gpu-only guest; VERDICT.md has the full path:line trace",
  "kernel_refs": [
    "sys/dev/drm/i915/intel_psr.c:418",
    "sys/dev/drm/i915/intel_psr.c:421",
    "sys/dev/drm/i915/intel_psr.c:430",
    "sys/dev/drm/i915/intel_psr.c:205",
    "sys/dev/drm/i915/i915_reg.h:4217",
    "sys/dev/drm/include/drm/drm_dp_helper.h:800"
  ],
  "poc_changes": "No kernel PoC seed existed; authored a standalone deterministic demo mirroring the exact kernel arithmetic and field definitions",
  "attempts": 1,
  "guest_uname": "DragonFly dfbsd 6.5-DEVELOPMENT DragonFly 6.5-DEVELOPMENT #0: Thu Jul  2 06:02:54 UTC 2026 root@dfbsd:/usr/obj/usr/src/sys/X86_64_GENERIC x86_64",
  "runtime_sec": 3,
  "guest_dirty": 0,
  "build_cmd": "cc -O2 -o /tmp/psr2_reg_demo /tmp/psr2_reg_demo.c",
  "run_cmd": "/tmp/psr2_reg_demo",
  "code_hash": "56e57cbdbabf62cf582af9e07137a5d3be9dfb35dc7ee9f2464d3e5fe37fe16d",
  "notes": "Status inconclusive = guest lacks the target device (virtio-gpu only; i915.ko present but no Intel VGA to bind; amdgpu/PSR2 hardware absent). Demo executed on the guest to prove the encoding math. Fix validation not possible for the same reason. Fix authored against read-only sys/ tree in fix.diff (reject PSR2 when sink_sync_latency+1 > EDP_PSR2_IDLE_FRAME_MASK).",
  "recommended_fix": "In intel_psr2_config_valid() reject PSR2 when dev_priv->psr.sink_sync_latency + 1 > EDP_PSR2_IDLE_FRAME_MASK (4-bit fields cannot hold 16)",
  "fix_status": "not_testable",
  "fix_baseline_reproduced": 0,
  "fix_patched_reproduced": 0,
  "fix_verdict": "Cannot build the fixed kernel path on this guest: no Intel display hardware; the MMIO write under test never executes. fix.diff is a one-hunk guard in intel_psr2_config_valid() reviewed against the exact field widths (i915_reg.h:4217-4222).",
  "fix_evidence": "fix.diff"
}