# DF-4601 VERDICT — not_reproduced on guest (target ASIC absent); logic defect CONFIRMED by mirror; severity Info

## The defect (static proof, no hardware needed)

`dce112_compressor_construct()` (dce112_compressor.c:787-829) runs on a
`kzalloc`ed object (created at :831-841), so every field starts at 0:

1. **Dead guard.** `if (compressor->base.memory_bus_width == 64)` at :802 is
   evaluated while the field is still **0**; it is assigned its real value,
   `ctx->asic_id.vram_width`, only afterwards at :810. The guard whose
   comment says "if only 1 [DRAM channel] then LPT should not be supported"
   can therefore never fire — `LPT_SUPPORT` stays set on 64-bit-bus ASICs.
2. **Wiped field.** `lpt_channels_num = 1` at :797 ("For DCE 11 always use
   one DRAM channel for LPT") is unconditionally overwritten to 0 at :818
   (part of the zero-everything block). No other code in the tree writes the
   field (verified across `sys/dev/drm/amd/display/dc/`), so at the only read
   — the switch in `dce112_compressor_program_lpt_control()` (:675-691) — it
   is always 0: the sole valid `case 1:` is unreachable and the switch always
   falls to `default` (:686), leaving `LOW_POWER_TILING_MODE` unprogrammed
   (stale HW value).

**Knock-on (same construct + tree-wide grep):** `banks_num`, `raw_size`,
`channel_interleave_size`, `dram_channels_num` are zeroed (:814-817) and
never set anywhere, so `lpt_size_alignment()` (:98-103) always returns 0:
`rows_per_channel` stays 0 (:708-714) and the compressed-surface address
alignment is skipped (:500-505) — while `dce112_compressor_enable_lpt()`
(:594-651) can still arm LPT (`LOW_POWER_TILING_ENABLE=1` at :645-650,
`GMCON_LPT_TARGET = stale_mode+1` at :628-640) whenever FBC+LPT come up on
eDP (`dce110_hw_sequencer.c:enable_fbc` → `enable_lpt` when LPT_SUPPORT &&
paths_num<2 && w*h ≤ 2560*1600; `fbc_gpu_addr` IS set at runtime by
amdgpu_dm.c:376, so the path is live on real hardware).

## Verification performed

* `construct_order.c` — a statement-for-statement userspace mirror of
  construct() + the switch — built and run **on the audit guest** (host has
  no compiler): both proofs hold, `RESULT: DEFECT CONFIRMED`, exit 0
  (run.log). This is a *logic* proof, not a kernel-path execution.
* Kernel-path execution is impossible on this guest: it has no AMD GPU
  (QEMU virtio only), so the DRM register path cannot run. Status therefore
  `not_reproduced` / `impact none` (the orchestrator's status enum has no
  feature-absent value; `not_testable` is disallowed).
* Reachability is modeset-gated (`/dev/dri`, typically root/operator), eDP
  + FBC-memory + single-display preconditions further narrow it, and the
  consequence is register misconfiguration on the GPU (display underflow /
  possible hang — speculative), **not** kernel memory corruption. Filed at
  **Info** severity with **certain** confidence in the (provable) logic
  defect itself.

## Fix validation

`fix.diff` (minimal reorder: assign `memory_bus_width` before the ==64
check; set `lpt_channels_num = 1` after the zeroing block instead of wiping
it) — cannot be kernel-validated on this guest (driver cannot attach), so
`fix_status = not_testable`. The diff was authored against the pristine
`sys/` tree and applies by construction.

## Guest state

Guest used only to compile/run the userspace mirror; returned clean via
`vm.sh reset with-src` after evidence capture.

## Fix status (batch validation)
Applied with the 36 sibling fix.diffs of this batch in findings/poc/_batch41/all_fixes.patch; single in-guest `make -j6 nativekernel KERNCONF=X86_64_GENERIC` completed RC=0 with zero errors under -Werror (full log: findings/poc/_batch41/fix_build8.log). Behavior A/B intentionally skipped for this Info-tier item.