{
  "finding_id": "DF-4621",
  "status": "untested",
  "reproduced": 0,
  "impact": "none",
  "confidence": "certain",
  "verdict": "Kernel path UNTESTABLE on this guest: amdgpu_dm_debugfs.c is not compiled (absent from sys/dev/drm/amd/amdgpu/Makefile SRCS :195-201; callers #if defined(CONFIG_DEBUG_FS) at amdgpu_dm.c:478/:4119, undefined in kconfig.h) and the guest has no AMD GPU (no AMD PCI devices). Source-level analysis is certain: the single OR-combined valid_input flag (amdgpu_dm_debugfs.c:195-221) accepts an invalid lane_count whenever the link_rate parses; it is stored unvalidated (dc.c:484) and consumed by dp_phy_settings_writes lane_settings[LANE_COUNT_DP_MAX=4] write loop (:403 \u2014 stack OOB write; unbounded linear smash for lane_count 0xffffffff) and by the LIVE decide_link_settings (dc_link_dp.c:1523 verbatim propagation into link training). Supporting runtime logic-proof ran on the guest: the transcribed validation accepts 5 a, stores lane_count=5, and the consumer loop performs OOB iteration r=4 \u2014 gcc itself warns iteration 4 invokes undefined behavior (demo_run.log). Latent enable-day hazard; fix.diff splits the two flags.",
  "exploit_chain": "",
  "evidence": "demo_run.log (guest): ACCEPTED by the single valid_input flag, stored preferred_link_setting.lane_count = 5 (dc.c:484, unvalidated), loop iteration r=4: OOB write at &lane_settings[4] -- past lane_settings[LANE_COUNT_DP_MAX-1=3] plus gcc -Waggressive-loop-optimizations warning; README/VERDICT cite the dead-build proof (Makefile:195-201, amdgpu_dm.c:478,4119).",
  "kernel_refs": [
    "sys/dev/drm/amd/display/amdgpu_dm/amdgpu_dm_debugfs.c:195",
    "sys/dev/drm/amd/display/amdgpu_dm/amdgpu_dm_debugfs.c:205",
    "sys/dev/drm/amd/display/amdgpu_dm/amdgpu_dm_debugfs.c:217",
    "sys/dev/drm/amd/display/amdgpu_dm/amdgpu_dm_debugfs.c:227",
    "sys/dev/drm/amd/display/amdgpu_dm/amdgpu_dm_debugfs.c:386",
    "sys/dev/drm/amd/display/amdgpu_dm/amdgpu_dm_debugfs.c:403",
    "sys/dev/drm/amd/display/dc/core/dc.c:484",
    "sys/dev/drm/amd/display/dc/core/dc_link_dp.c:1523",
    "sys/dev/drm/amd/display/include/link_service_types.h:71",
    "sys/dev/drm/amd/display/dc/dc_dp_types.h:37",
    "sys/dev/drm/amd/amdgpu/Makefile:195"
  ],
  "poc_changes": "no kernel PoC possible (file not in build; no AMD GPU); wrote a 1:1 transcription logic demo (dp_link_logic_demo.c) compiled and run on the guest instead",
  "attempts": 1,
  "guest_uname": "DragonFly dfbsd 6.5-DEVELOPMENT #0: Thu Jul 2 06:02:54 UTC 2026 root@dfbsd:/usr/obj/usr/src/sys/X86_64_GENERIC x86_64",
  "runtime_sec": 30,
  "guest_dirty": 0,
  "build_cmd": "cc -O2 -Wall -o demo dp_link_logic_demo.c   (guest, logic transcription)",
  "run_cmd": "./demo",
  "code_hash": "29a579ee47e35eb1d12b5c6e37fdec25e0d0bf3e6071fd2183048ddd8bcc934c",
  "fix_status": "not_testable",
  "fix_baseline_reproduced": 0,
  "fix_patched_reproduced": 0,
  "fix_verdict": "fix.diff is the standard upstream-style split (valid_lane_count && valid_link_rate); cannot be kernel-validated on this guest (file not compiled, no AMD GPU). The logic demo rejects lane_count=5 under the split by construction.",
  "fix_evidence": "fix.diff (mechanically generated, clean apply); demo validates the rejection branch when the flag is split.",
  "notes": "Pass-2 new finding on the assigned file. Distinct from known DF-1764 (leak on put_user failure) and DF-1765 (uninit param[]): those cover the parse/leak; this covers the validation-logic flaw and its write sink. Dead-code severity kept Medium (not Low like DF-1764/1765/DF-4554) because the sink is an OOB WRITE primitive.",
  "recommended_fix": "Split valid_input into valid_lane_count and valid_link_rate and require both before storing preferred link settings (see fix.diff)."
}