# DF-4912 — stats module: latent OOB write in `mod_stats_update_event` on `length == 0`, in code that is not compiled into any kernel build

File: `sys/dev/drm/amd/display/modules/stats/stats.c:316-321`
Severity: Info | CWE-787 (latent) / dead code | confidence: certain

## Two facts, both proven without hardware

1. **The module is dead code.** `sys/dev/drm/amd/amdgpu/Makefile:49-51` builds
   `display/modules/{freesync,color,info_packet}` — **not** `modules/stats`.
   No file in `sys/` references `modules/stats` or calls any `mod_stats_*`
   function (repo-wide `rg` — zero hits outside the module itself and its
   header). The object is never compiled, never linked, never callable.

2. **Latent defect.** If the module were ever wired up:
   ```c
   copy_length = length;                       /* stats.c:316 */
   if (length > MOD_STATS_EVENT_STRING_MAX)
       copy_length = MOD_STATS_EVENT_STRING_MAX;
   memcpy(&events[index].event_string, event_string, copy_length);
   events[index].event_string[copy_length - 1] = '\0';   /* :321 */
   ```
   With `length == 0` this executes `event_string[-1] = '\0'` — a one-byte
   write *before* the 512-byte array, i.e. into the high byte of
   `entry_id` (offset 3 of `struct stats_event_cache`, little-endian) —
   CWE-787 off-by-one. The very next statement
   (`events[index].entry_id = core_stats->entry_id;`, :323) rewrites that
   exact word, so the corruption is self-clobbering; net effect on the
   struct is zero. No caller exists to pass 0 today.

## Build / run (semantic demonstration of the off-by-one only)

```
./build.sh   # cc -o stats_len0_demo stats_len0_demo.c
./run.sh     # standalone extraction of the exact kernel logic; shows the
             # write lands at buffer[-1] and is then overwritten
```

The demo proves the index arithmetic; it does NOT execute kernel code (none
exists in the build).

## Recommendation

Delete `sys/dev/drm/amd/display/modules/stats/` (matches upstream direction —
the module was never wired into the amdgpu driver), or — if it is kept for
future wiring — apply `fix.diff` (guard `length == 0` / clamp to
`MOD_STATS_EVENT_STRING_MAX - 1`).