{
  "finding_id": "DF-4556",
  "status": "not_reproduced",
  "reproduced": 0,
  "impact": "none",
  "confidence": "likely",
  "verdict": "Code-provable reassembly defect: read_command() advances ctx->offset on short (partial-ACK) reads (dce_aux.c:426-433) and re-requests the remainder, but process_read_request() pins the reply destination to the buffer base (ctx->reply.data = ctx->buffer, dce_aux.c:502), so every subsequent chunk overwrites buffer[0..] while the tail stays zeroed by the loop memset (dce_aux.c:581). The driver then reports SUCCEEDED with corrupted DPCD/EDID content. The copy itself is bounded (returned_byte <= current_read_length <= payload.length), so this is data corruption, not memory unsafety — a DP-spec-legal short read from a hostile/marginal sink poisons link-training inputs. Not reproduced on the audit guest: no AMD GPU / no DP sink (env.txt); trigger requires a programmable sink per trigger.md. Distinct from DF-1694 (write-path overflow into fixed reply_data[16]); this is the read path, correct bounds, wrong offset.",
  "exploit_chain": "",
  "evidence": "VERDICT.md (offset-vs-base proof with path:line); trigger.md (DP sink short-read recipe); fix.diff (one-line offset fix mirroring request side at dce_aux.c:583)",
  "kernel_refs": [
    "sys/dev/drm/amd/display/dc/dce/dce_aux.c:501",
    "sys/dev/drm/amd/display/dc/dce/dce_aux.c:581",
    "sys/dev/drm/amd/display/dc/dce/dce_aux.c:426"
  ],
  "poc_changes": "Seed replaced: no userspace trigger exists (hardware behavior required); trigger.md documents the sink-side recipe.",
  "attempts": 1,
  "guest_uname": "DragonFly dfbsd 6.5-DEVELOPMENT DragonFly 6.5-DEVELOPMENT #0: Thu Jul  2 06:02:54 UTC 2026 root@dfbsd:/usr/obj/usr/src/sys/X86_64_GENERIC x86_64",
  "runtime_sec": 5,
  "guest_dirty": 0,
  "build_cmd": "n/a",
  "run_cmd": "./run.sh",
  "code_hash": "",
  "notes": "Hardware-gated (AMD DC GPU + short-read DP sink). Impact ceiling: kernel-assembled DPCD/EDID corruption with attacker-controlled chunk placement order; data integrity only, no memory unsafety.",
  "recommended_fix": "ctx->reply.data = ctx->buffer + ctx->offset in process_read_request() (dce_aux.c:502), mirroring the request side at :583.",
  "fix_status": "not_testable",
  "fix_baseline_reproduced": 0,
  "fix_patched_reproduced": 0,
  "fix_verdict": "Fix not validated on guest: baseline cannot run (no AMD GPU). fix.diff is a one-line, line-accurate change; validated by inspection only.",
  "fix_evidence": "findings/poc/DF-4556/fix.diff"
}