{"finding_id":"DF-4808","status":"untested","attempts":0,"reproduced":0,"impact":"none","confidence":"likely","verdict":"Hardware-gated data-integrity defect (no kernel memory unsafety - all writes caller-sized): three coupled accounting defects in the DCE110 hw I2C engine - (1) process_transaction zeroes its local length in the write loop then accounts buffer_used_bytes += length+1, so WRITE transactions account only the address byte and get_hw_buffer_available_size overstates free space for MOT batches (the submit_request guard admits more than the HW circular buffer holds); (2) counters/DC_I2C_TRANSACTIONn registers only reset in execute_transaction - an ENGINE_BUSY abort or release between sub-transactions leaves stale state so the next acquire lands payloads with INDEX_WRITE skipped and re-executes the aborted chain (garbage DDC/EDID traffic until some chain completes); (3) I2C_HW_BUFFER_SIZE=538 exceeds the 8-bit DC_I2C_INDEX/COUNT0 field masks (latent truncation >255). Upstream twin exists (Linux dce110/dce80 identical). No AMD GPU on guest - skipped per Low severity. Account-original-length + reset-on-release + clamp fix.","exploit_chain":"interleave a multi-payload WRITE-MOT DDC batch with a busy engine (submit_channel_request is_hw_busy path) -> next EDID read executes against stale TRANSACTION registers and stale DC_I2C_INDEX base -> corrupted EDID / persistent DDC failure","evidence":"findings/poc/DF-4808/ (this verdict)","kernel_refs":["sys/dev/drm/amd/display/dc/i2caux/dce110/i2c_hw_engine_dce110.c:334","sys/dev/drm/amd/display/dc/i2caux/dce110/i2c_hw_engine_dce110.c:362","sys/dev/drm/amd/display/dc/i2caux/i2c_hw_engine.c:91-96","sys/dev/drm/amd/include/asic_reg/dce/dce_11_0_sh_mask.h:16266"],"guest_uname":"","code_hash":""}