# VERDICT — DF-4911

**status: untested** (runtime requires AMD DM hardware performing real AUX
writes; the audit guest has no AMD display device and the raw AUX chardev is
compiled out — `CONFIG_DRM_DP_AUX_CHARDEV` absent from
`sys/dev/drm/kconfig.h`, verified `sys/conf/files:2294` builds drm_dp_aux_dev.c
but registration is gated on that config). **reproduced: 0**.

## The defect (certain, from source)

`dm_dp_aux_transfer` (`sys/dev/drm/amd/display/amdgpu_dm/amdgpu_dm_mst_types.c`):

- `DP_AUX_NATIVE_WRITE` case, lines 105-117: the return value of
  `dc_link_aux_transfer()` is discarded and `result = msg->size;` is
  assigned unconditionally.
- `DP_AUX_I2C_WRITE` case, lines 133-148: identical discard.

`dc_link_aux_transfer` (`sys/dev/drm/amd/display/dc/core/dc_link_ddc.c:635-686`)
returns `-1` for `AUX_CHANNEL_OPERATION_FAILED_REASON_UNKNOWN /
INVALID_REPLY / TIMEOUT` (lines 678-682) and `0` for HPD-disconnect
(line 675-677). None of these reach the caller on the write paths: the DRM DP
core (`drm_dp_dpcd_write`, `sys/dev/drm/drm_dp_helper.c:334`) interprets the
returned `msg->size` (> 0) as *full success*.

Consequence: a DPCD/I2C write that NACKed, timed out, or raced an HPD
disconnect is silently reported as delivered. Consumers that trust it:

- MST sideband DOWN_REQ transmission (`drm_dp_mst_topology.c` tx path builds
  messages with `drm_dp_dpcd_write` to `DP_SIDEBAND_MSG_DOWN_REQ_BASE`) — the
  core's sequence numbers advance although the branch never saw the request;
  the topology state machine desyncs from the hub.
- Payload allocation writes (`PAYLOAD_ALLOC_SET`) believed programmed.
- Link-training DPCD writes believed acknowledged.

Threat: a hostile or failing DP/MST device (evil-dongle class) that NACKs
writes while the driver reads plausible DPCD data causes persistent display
deadlocks and payload-table confusion — functional DoS, no memory corruption
identified (sizes are separately capped at 16 by the `WARN_ON(msg->size > 16)`
guard at line 89, which is correct; `msg->reply` is filled by DC on all
paths). Impact ceiling: local display DoS on AMD hardware; hence **Low**.

## Guest evidence

`run.log`: probe builds; guest reports `NO_AMD_PCI_DEVICE`, `NO_DEV_DRI`,
and no `/dev/drm_dp_aux*` devices. Path unreachable at runtime on this
guest.

## Fix

Assign the return value on both write paths exactly like the read paths
(`fix.diff`, mirrors the eventual upstream unification of all four cases).

## Fix status (batch validation)
Applied with the 36 sibling fix.diffs of this batch in findings/poc/_batch41/all_fixes.patch; single in-guest `make -j6 nativekernel KERNCONF=X86_64_GENERIC` completed RC=0 with zero errors under -Werror (full log: findings/poc/_batch41/fix_build8.log). Behavior A/B intentionally skipped for this Info-tier item.