# DF-4495 VERDICT

**Status: untested** (kernel-level) — model-confirmed. **Impact: none on
this guest** (hardware-gated). **Confidence: certain** (source).

## Reproduced?

At the *kernel* level: no — and it cannot be on this guest. `env.txt`
records 0 AMD/ATI PCI devices; `dce100_create_resource_pool` and
`dce100_link_encoder_create` only execute during `amdgpu` bind on a DCE10
(Tonga/Topaz) ASIC, which the QEMU guest does not have. This is the same
verification ceiling as the accepted family twins DF-4352 (dce110) and
DF-4375 (dce112).

What *was* verified:

1. **Line-accurate source trace.** The three index expressions are at
   `dce100_resource.c:573-575`, formed from `enc_init_data` fields filled
   at `core/dc_link.c:1177-1183` by `get_hpd_line()` (:925-962),
   `get_ddc_line()` (:964-1004) and
   `translate_encoder_to_transmitter()` (:1006-1069) — all reading the
   VBIOS object tables via the bios parser, none validating range.
   Enum domains from `include/grph_object_defs.h:45-94`; table extents
   7/6/6 at `dce100_resource.c:232-240`, `:204-211`, `:218-225`.
2. **Guest-side index-domain model** (`df4495.c`, compiled with the guest
   `cc 8.3`, full output in `run.log`/`run.2.log`): the verbatim index
   expressions evaluated over every value the three producers can emit —
   4/11 transmitter (`UNKNOWN`(-1), `TRAVIS_CRT`(7), `TRAVIS_LCD`(8),
   `UNIPHY_G`(9)), 3/9 channel (`UNKNOWN`(0)→-1, `DDC_VGA`(7)→6,
   `I2C_PAD`(8)→7), 1/7 hpd (`UNKNOWN`(7)) are OOB — 8/27 reachable
   values; the concrete craftable triple TRAVIS_CRT+DDC_VGA+no-HPD makes
   all three lookups OOB simultaneously (indices 7/6/7).
3. **Consequence path**: `dce110_link_encoder_construct` stores the
   garbage pointers as `enc110->link_regs/aux_regs/hpd_regs`; every later
   `REG_*` access on that encoder (link detection, AUX/HPD setup at bind)
   dereferences them → wild MMIO (hang/machine-check), not a readable
   leak.

## Exploit chain

Crafted/flashed VBIOS (or malicious PCIe GPU) on a DCE10 board declares an
external TRAVIS encoder object, a VGA/I2C-pad DDC line, or a connector
without HPD mapping → `amdgpu` bind → `dc_link_construct` fills
`enc_init_data` with UNKNOWN/out-of-range enum values →
`dce100_link_encoder_create` performs the OOB const-table reads → bogus
register bases stored → first encoder register access issues MMIO at
VBIOS-chosen offsets. Requires firmware/hardware control; no unprivileged
or remote path. Severity Low (family precedent).

## Fix validation

`fix.diff` bounds-checks the three values (identical shape to the accepted
DF-4352 fix) and returns NULL; the caller `dc_link.c:1184-1190` already
fails that single link cleanly on NULL, so the driver continues with the
remaining links. `git apply --check` passes against the read-only tree.
Fix not kernel-testable on this guest (no AMD device):
`fix_status: not_testable`.

## Negative checks performed on this file (pass-2 depth)

- All other register-table lookups are bounded: `dce100_tg_offsets[6]`
  indexed `i < pipe_count(6)` (:977-982); mi/ipp/xfm/opp/aux/i2c regs[6]
  indexed `i < pipe_count` / `i < num_ddc(6)` (:989-1036);
  `clk_src_regs[3]` with `clk_src_count ∈ {2,3}` (:884-906);
  `audio_regs[7]` with `inst ≤ min(pipe_count, num_audio)=6`
  (dc_resource.c:232-247); `stream_enc_regs[7]` with `eng_id ≤
  num_stream_encoder=6` (dc_resource.c:252-257). Only the three
  link-encoder lookups are VBIOS-indexed.
- `destruct()` (:678-745) loops `pipe_count`/`num_ddc`/`stream_enc_count`/
  `clk_src_count`/`audio_count`, all set before the allocations they
  bound and all NULL-guarded — no double-free/UAF on the unwind path.
- The i2c 1-based-regs vs 0-based-slot pairing (:614-621 vs :1030) is the
  upstream-intended DC_I2C engine↔DDC-select mapping
  (`dce_i2c_hw.c:282`), not an off-by-one.
- `dce100_validate_global`/`validate_surface_sets` (:789-818):
  `stream_status[i]` is maintained in lockstep with `streams[i]` by the
  dc core; `plane_states[0]` is only read when `plane_count == 1`. No
  join arithmetic exists for DCE10 (no underlay/MPC joins).
- `populate_dml` does not exist for DCE10 (no DML);
  `dce100_validate_bandwidth` hardcodes clocks (:777-784) — functional
  TODO only.

## Fix status (batch validation)
Applied with the 36 sibling fix.diffs of this batch in findings/poc/_batch41/all_fixes.patch; single in-guest `make -j6 nativekernel KERNCONF=X86_64_GENERIC` completed RC=0 with zero errors under -Werror (full log: findings/poc/_batch41/fix_build8.log). Behavior A/B intentionally skipped for this Info-tier item.