{
  "finding_id": "DF-4912",
  "status": "untested",
  "reproduced": 0,
  "impact": "none",
  "confidence": "certain",
  "verdict": "sys/dev/drm/amd/display/modules/stats/stats.c is dead code: sys/dev/drm/amd/amdgpu/Makefile:49-51 builds modules/{freesync,color,info_packet} but not modules/stats, and no file in sys/ calls any mod_stats_* function (verified on the guests /usr/src too). Inside the never-compiled module, mod_stats_update_event has a latent off-by-one: with length==0, copy_length-1 wraps unsigned and event_string[-1]=\\0 writes one byte before the 512-byte array (into entry_ids MSB; stats.c:323 then rewrites entry_id wholesale, so net corruption is zero). gcc 8.3s -Warray-bounds flags the exact expression when the clone is built (run.log); the standalone demo shows the write lands at offset 3 and is clobbered. Info severity: recommend deleting the module or applying fix.diff.",
  "exploit_chain": "",
  "evidence": "run.log (guest: Makefile lists freesync/color/info_packet only; -Warray-bounds warning array subscript 4294967295; demo output PROVEN: write landed at event_string[-1]), VERDICT.md (killed-candidates list), fix.diff.",
  "kernel_refs": [
    "sys/dev/drm/amd/display/modules/stats/stats.c:296",
    "sys/dev/drm/amd/display/modules/stats/stats.c:316",
    "sys/dev/drm/amd/display/modules/stats/stats.c:321",
    "sys/dev/drm/amd/display/modules/stats/stats.c:323",
    "sys/dev/drm/amd/amdgpu/Makefile:49"
  ],
  "poc_changes": "No seeded PoC; wrote stats_len0_demo.c (byte-exact clone of the kernel logic); first build failed on missing <stddef.h>, fixed and rerun.",
  "attempts": 2,
  "guest_uname": "DragonFly dfbsd 6.5-DEVELOPMENT DragonFly 6.5-DEVELOPMENT #0: Thu Jul 2 06:02:54 UTC 2026 root@dfbsd:/usr/obj/usr/src/sys/X86_64_GENERIC x86_64",
  "runtime_sec": 60,
  "guest_dirty": 0,
  "build_cmd": "cc -O2 -Wall -o stats_len0_demo stats_len0_demo.c",
  "run_cmd": "./run.sh",
  "code_hash": "274b4d5d0ceb7d1e625f1f60572fb829de080c8f7d5a032ad612168bacf1d8a7",
  "notes": "Dead code \u2014 nothing to test at kernel level; the userspace clone demonstrates the index arithmetic only. All other stats.c bounds guards verified correct.",
  "recommended_fix": "Delete modules/stats (never wired into the amdgpu build) or guard length==0 and clamp copy_length to MOD_STATS_EVENT_STRING_MAX-1 (fix.diff).",
  "fix_status": "not_applicable",
  "fix_baseline_reproduced": 0,
  "fix_patched_reproduced": 0,
  "fix_verdict": "Not applicable: the defective code is not compiled into any kernel or module build; there is no baseline to patch-and-compare.",
  "fix_evidence": "sys/dev/drm/amd/amdgpu/Makefile:49-51 (no stats entry); fix.diff provided for the delete-later alternative."
}