{
  "finding_id": "DF-4565",
  "status": "untested",
  "reproduced": 0,
  "impact": "none",
  "confidence": "certain",
  "verdict": "Latent one-past-the-end index in radeon_legacy_tv_mode_set()s flicker-filter table walk (sys/dev/drm/radeon/radeon_legacy_tv.c:647-660): the SLOPE_limit[] match loop has no out-of-loop bound, so a non-matching flicker_removal would index SLOPE_value[5]/YCOEF_value[5]/YCOEF_EN_value[5] one past the [5]-element arrays. Proven unreachable with the compiled-in constants (flicker_removal is always 2 or 3, both present in SLOPE_limit={6,5,4,3,2}), and the audit guest has no radeon hardware, so no PoC is possible or needed; filed as Info hardening.",
  "exploit_chain": "",
  "evidence": "findings/poc/DF-4565/README.md (code shape + unreachability arithmetic); sys/dev/drm/radeon/radeon_legacy_tv.c:269-272 (arrays), :643-650 (match loop), :652-660 (indexed uses)",
  "kernel_refs": [
    "sys/dev/drm/radeon/radeon_legacy_tv.c:647",
    "sys/dev/drm/radeon/radeon_legacy_tv.c:652",
    "sys/dev/drm/radeon/radeon_legacy_tv.c:269"
  ],
  "poc_changes": "no PoC attempted: device absent from guest and defect unreachable with current tables (Info finding)",
  "attempts": 0,
  "guest_uname": "DragonFly dfbsd 6.5-DEVELOPMENT #0 X86_64_GENERIC x86_64",
  "runtime_sec": 0,
  "guest_dirty": 0,
  "build_cmd": "",
  "run_cmd": "",
  "code_hash": "",
  "notes": "Pass-2 re-audit of radeon_legacy_tv.c otherwise clean: all array walks bounded by MAX_H/V_CODE_TIMING_LEN vs [32] arrays (radeon_mode.h:293-294); tv_std only from the DRM enum property (0..8 validated); h_pos/v_pos/h_size are kzalloc-zero with no writable property in this tree, killing the 32-bit-mult-overflow and h_inc divide paths; UV_INC field (16-bit, radeon_reg.h:3569) is never 0 for the reachable constants so line 670 cannot divide by zero.",
  "recommended_fix": "Clamp the SLOPE table index after the match loop (i = min(i, ARRAY_SIZE(SLOPE_limit)-1))."
}