# DF-4642 — dce_virtual_pageflip reads crtcs[crtc_id] before bounds-checking crtc_id

- File: `sys/dev/drm/amd/amdgpu/dce_virtual.c:662-667`
- Severity: Info (hardening) — latent OOB read; no demonstrated impact on this tree
- Status: **untested** — requires an AMD GPU with the amdgpu kld module loaded and
  `amdgpu.virtual_display=1`; the audit QEMU guest has no AMD GPU and amdgpu is not
  in GENERIC (module-only: `sys/dev/drm/amd/amd/Makefile`), so the code path cannot
  be exercised here.

## Why it is still latent-only today

`dce_virtual_pageflip()` is `static` and has exactly one caller:
`dce_virtual_vblank_timer_handle()` (dce_virtual.c:708) which passes
`amdgpu_crtc->crtc_id` — always `index` from `dce_virtual_crtc_init()` in
`[0, adev->mode_info.num_crtc)` and `num_crtc` is clamped to 1..6
(amdgpu_device.c:1271-1275) against `crtcs[AMDGPU_MAX_CRTCS=6]`
(amdgpu_mode.h:65,327). So the pre-check dereference at line 662 never indexes OOB
from the current call graph; it becomes a live OOB read the moment any future
caller passes an unchecked id (upstream Linux carries the same inverted order).

## Fix

Move the `crtc_id >= num_crtc` test above the array access.