# VERDICT — DF-4612

**Status: not_reproduced** (target hardware absent from the audit guest — no
AMD GPU / amdgpu driver instance; VBIOS command-table parsing never executes
there). The defect is proven statically, line-accurate, with certain
confidence.

## Narrative

`init_transmitter_control()` (command_table2.c:176-192) asks the ATOM master
command table for the `dig1transmittercontrol` entry's revision:

```c
uint8_t frev; uint8_t crev;
if (BIOS_CMD_TABLE_REVISION(dig1transmittercontrol, frev, crev) == false)
        BREAK_TO_DEBUGGER();
switch (crev) {
case 6:  bp->cmd_tbl.transmitter_control = transmitter_control_v1_6; break;
default: bp->cmd_tbl.transmitter_control = NULL; break;
}
```

`amdgpu_atom_parse_cmd_header()` (amdgpu/atom.c:1405-1420):

```c
int idx = CU16(ctx->cmd_table + offset);
u16 *mct = (u16 *)(ctx->bios + ctx->cmd_table + 4);
if (!mct[index])
        return false;               /* <-- *frev/*crev NEVER written */
*frev = CU8(idx + 2);
*crev = CU8(idx + 3);
```

So on a VBIOS image whose master command table has a zero pointer for the
`dig1transmittercontrol` slot (malformed / attacker-reflashed / truncated
image — the image is otherwise barely validated at this point per DF-4345),
`crev` keeps its uninitialized stack value and steers the switch.

`BREAK_TO_DEBUGGER()` is `ASSERT(0)` → `WARN_ON(1)` in release
(dc/os_types.h:72-79): warns, does not stop execution.

## Impact assessment (honest ceiling)

* uninitialized stack byte read that influences control flow;
* garbage `6` → binds v1_6 handler; its later `EXEC_BIOS_CMD_TABLE` resolves
  the master-table entry to `base == 0` and `amdgpu_atom_execute_table_locked`
  returns `-EINVAL` (atom.c:1206-1207) → clean `BP_RESULT_FAILURE`;
* garbage `!= 6` → NULL pointer stored; all call sites NULL-check
  (bios_parser2.c:1004) → clean failure.

No OOB, no info leak out of the kernel. Severity Low (hardening class),
consistent with the DF-4047 v1 twin. The realistic attack prerequisite (a
VBIOS image you control on the card) already implies greater power, which is
why this stays Low.

## Why not reproduced on the guest

`env.txt`: the audit guest is QEMU with a virtio-vga GPU (`vgapci0
chip=0x11111234`), no AMD display PCI device, no amdgpu/drm-amd module
loaded. `command_table2.c` is only reachable during amdgpu DC construction.
No PoC can exercise it there. Static trace is complete and cited.

## Fix

Initialize `crev = 0` and bail out of `init_transmitter_control()` when
`BIOS_CMD_TABLE_REVISION` fails (setting the handler to NULL, which callers
already handle). See `fix.diff`.

## Fix status (batch validation)
Applied with the 36 sibling fix.diffs of this batch in findings/poc/_batch41/all_fixes.patch; single in-guest `make -j6 nativekernel KERNCONF=X86_64_GENERIC` completed RC=0 with zero errors under -Werror (full log: findings/poc/_batch41/fix_build8.log). Behavior A/B intentionally skipped for this Info-tier item.