{
  "finding_id": "DF-4853",
  "status": "inconclusive",
  "reproduced": 0,
  "impact": "none",
  "confidence": "certain",
  "verdict": "Driver path hardware-gated on this guest (no radeon GPU, no /dev/dri), so evergreen_hdmi_enable/evergreen_dp_enable can never execute here; the type confusion is nonetheless proven statically with exact lines and machine-verified offsets, and the corruption PRIMITIVE is proven live on the guest kernel: evergreen_hdmi.c:429 loads radeon_encoder->enc_priv as a 312-byte radeon_encoder_atom_dig, but every LCD-carrying digital encoder (each eDP panel: UNIPHY*+ATOM_DEVICE_LCD_SUPPORT, atombios_encoders.c:2862-2869 and :2824-2836) carries a 280-byte radeon_encoder_lvds; the guard at evergreen_hdmi.c:431 reads dig->afmt (+288) OUT OF BOUNDS -- 8 bytes into the ADJACENT 288-byte slab chunk (zero slack) -- and consumes the garbage: non-NULL falls through, dig->afmt->offset feeds six WREG32 sites (:438-455) and dig->afmt->enabled = enable (:458; twin at :513) is a write through the OOB-read pointer. NEW vs DF-4635 (radeon_audio.c:262-480 sinks) and DF-4828 (r600_hdmi.c walk sinks): these are evergreen_hdmi.cs own dpms sinks, and DF-4828s dismissal of the dpms route is wrong for eDP -- an eDP connector yields ATOM_ENCODER_MODE_DP (atombios_encoders.c:824-829) so the radeon_audio_dpms gate at atombios_encoders.c:1848-1851 PASSES while the encoder carries the lvds-typed enc_priv, and radeon_audio_detect (radeon_audio.c:461-472) assigns hdmi_funcs (.dpms = evergreen_hdmi_enable, radeon_audio.c:206) to the eDP encoder; every screen blank/unblank on a DCE4+ eDP laptop walks the corrupted path. KLD replica on the live allocator: OOB read returned the groomed adjacent-chunk pointer, the :431 guard fell through, afmt->offset 0x5678 collected as the MMIO value, afmt->enabled flipped 0->1->0 through the garbage pointer (both dpms directions); zeroed neighbor = silent return (field-hiding case).",
  "exploit_chain": "(hardware-gated, not runnable here) groom the 288-byte slab size class so a chosen victim follows the lvds enc_priv allocation -> eDP dpms transition (screen blank/unblank, modeset, DRM_IOCTL_MODE_DPMS by an unprivileged DRM client) -> evergreen_hdmi_enable -> OOB read dig->afmt = victim[0..8) -> non-NULL: wild read (->offset programs HDMI_INFOFRAME_CONTROL0/AFMT_AUDIO_PACKET_CONTROL MMIO) + wild write dig->afmt->enabled at victim[0..8)+0 on every dpms on AND off -> NULL neighbor silently returns, garbage neighbor panics, groomed victim = controlled through-pointer write -> crash-to-UAF escalation path; deterministic per dpms transition on affected laptops.",
  "evidence": "run.log (KLD: usable chunk=288, adjacent pair B-A=288, OOB READ dig->afmt(+288)==groomed ptr non-NULL, guard at evergreen_hdmi.c:431 falls through, afmt->offset 0x5678 collected for WREG32 sites, afmt->enabled written 0->1->0 through the OOB-read pointer (:458), NULL case silent); build.log + evg_offsets output (lvds=280 atom_dig=312 afmt@+288 afmt.enabled@+0 machine-verified); fix_build.log (patched radeon.ko rebuilds -Werror, RC=0); VERDICT.md full dispatch-chain citations incl. the DF-4828 dismissal correction",
  "kernel_refs": [
    "sys/dev/drm/radeon/evergreen_hdmi.c:429-461",
    "sys/dev/drm/radeon/evergreen_hdmi.c:470-514",
    "sys/dev/drm/radeon/radeon_audio.c:206",
    "sys/dev/drm/radeon/radeon_audio.c:461-472",
    "sys/dev/drm/radeon/radeon_audio.c:777-783",
    "sys/dev/drm/radeon/atombios_encoders.c:1848-1851",
    "sys/dev/drm/radeon/atombios_encoders.c:824-829",
    "sys/dev/drm/radeon/atombios_encoders.c:2862-2869",
    "sys/dev/drm/radeon/radeon_connectors.c:1764-1768",
    "sys/dev/drm/radeon/radeon_mode.h:427-445",
    "sys/kern/kern_slaballoc.c:638"
  ],
  "poc_changes": "no seed; wrote evg_dpms_probe.c KLD (verbatim replica of evergreen_hdmi_enables deref sequence on the live allocator with groomable adjacent victim) + evg_offsets.c (verbatim struct defs). One -Werror fix during build (uninitialized mmio[0]). fix.diff generated with real diff -u and compile-validated by a full radeon.ko rebuild (-Werror).",
  "attempts": 2,
  "guest_uname": "DragonFly dfbsd 6.5-DEVELOPMENT DragonFly 6.5-DEVELOPMENT #0: Thu Jul  2 06:02:54 UTC 2026  root@dfbsd:/usr/obj/usr/src/sys/X86_64_GENERIC  x86_64",
  "runtime_sec": 1500,
  "guest_dirty": 0,
  "build_cmd": "guest: cd /tmp/df4853 && cc -O -o evg_offsets evg_offsets.c && make   (KLD: evg_dpms_probe.c)",
  "run_cmd": "guest: kldload -v /tmp/df4853/evg_probe.ko && kldunload evg_probe   (fix: cd /usr/src && patch -p1 < fix.diff && cd sys/dev/drm/radeon && make)",
  "code_hash": "38eb60eef2acd6cdfb9ac6073b6f36c056f72b2feefca2beacc390907b37b9de",
  "notes": "Sibling sink in another file for the queue: atombios_get_encoder_mode derefs enc_priv as atom_dig (dig_enc->active_mst_links, atombios_encoders.c:741-744, +304 OOB read) BEFORE the connector switch, on every encoder-mode query. Negative results for this file: evergreen_set_avi_packet reads <=17B of a 20B stack buffer from radeon_audio.c:518 (in-bounds; unused size param); dce4_dp_audio_set_dto div guarded (:317) and the 100*clock u32 wrap is register-value-only; sad/sadb loops bounded by drm_edid_to_sad/speaker_allocation; dce4_afmt_write_latency_fields connector NULL-checked by radeon_audio.c:418 wrapper; dce4_audio_enable pin-checked (:46); DF-1934 (dce4_hdmi_set_color_depth NULL connector) known, not re-reported.",
  "recommended_fix": "Type-gate both sinks: early-return in evergreen_hdmi_enable/evergreen_dp_enable when (!dig || encoder->encoder_type == DRM_MODE_ENCODER_LVDS) -- enc_priv is radeon_encoder_lvds exactly for LVDS-registered encoders; see fix.diff",
  "fix_status": "not_testable",
  "fix_baseline_reproduced": 0,
  "fix_patched_reproduced": 0,
  "fix_verdict": "fix.diff applies clean (hunks at 428/485) and the whole radeon.ko module rebuilds with -Werror on the guest toolchain including the patched evergreen_hdmi.o (fix_build.log, RC=0). Behavioral validation impossible on this guest: no radeon GPU, so radeon_audio_dpms (the only route into both patched functions) never executes here; the KLD primitive harness is driver-path-independent by construction (it validates the geometry and the deref sequence, not the gate).",
  "fix_evidence": "fix.diff; fix_build.log (patched evergreen_hdmi.c compiled -Werror, radeon.ko relinked RC=0)"
}