# DF-4642 — VERDICT

**Not verified on the guest (untested).** The code-order defect is proven statically:

```c
static int dce_virtual_pageflip(struct amdgpu_device *adev, unsigned crtc_id)
{
	...
	amdgpu_crtc = adev->mode_info.crtcs[crtc_id];      /* 662: OOB read for bad id */

	if (crtc_id >= adev->mode_info.num_crtc) {         /* 664: check AFTER use */
		DRM_ERROR("invalid pageflip crtc %d\n", crtc_id);
		return -EINVAL;
	}
```

Chain traced:
- Only caller: `dce_virtual_vblank_timer_handle` (dce_virtual.c:708) passes
  `amdgpu_crtc->crtc_id`, initialized to `index < num_crtc` at dce_virtual.c:246.
- `num_crtc` clamped to `[1,6]` in `amdgpu_device_enable_virtual_display`
  (amdgpu_device.c:1271-1275); array is `crtcs[AMDGPU_MAX_CRTCS]`, AMDGPU_MAX_CRTCS=6
  (amdgpu_mode.h:65,327).
- Therefore no OOB is reachable from the current call graph → Info/hardening, not a
  demonstrable memory-safety bug on this tree.

Why untested rather than not_reproduced: the driver cannot even load on the audit
guest (no AMD PCI device; amdgpu exists only as a kld module,
`sys/dev/drm/amd/amd/Makefile` → SUBDIR amdgpu; GENERIC `sys/config/X86_64_GENERIC`
does not include it). Running the path would require AMD hardware.

## Recommended fix (dce_virtual.c)

```diff
--- a/sys/dev/drm/amd/amdgpu/dce_virtual.c
+++ b/sys/dev/drm/amd/amdgpu/dce_virtual.c
@@ -659,12 +659,12 @@ static int dce_virtual_pageflip(struct amdgpu_device *adev,
 	struct amdgpu_crtc *amdgpu_crtc;
 	struct amdgpu_flip_work *works;
 
-	amdgpu_crtc = adev->mode_info.crtcs[crtc_id];
-
 	if (crtc_id >= adev->mode_info.num_crtc) {
 		DRM_ERROR("invalid pageflip crtc %d\n", crtc_id);
 		return -EINVAL;
 	}
 
+	amdgpu_crtc = adev->mode_info.crtcs[crtc_id];
+
 	/* IRQ could occur when in initial stage */
 	if (amdgpu_crtc == NULL)
 		return 0;
```

## Fix status (batch validation)
Applied with the 36 sibling fix.diffs of this batch in findings/poc/_batch41/all_fixes.patch; single in-guest `make -j6 nativekernel KERNCONF=X86_64_GENERIC` completed RC=0 with zero errors under -Werror (full log: findings/poc/_batch41/fix_build8.log). Behavior A/B intentionally skipped for this Info-tier item.

(No fix.diff for this item: documented recommendation only - see Fix above.)