# DF-4932 VERDICT

**Status: reproduced (logic level, verbatim userland replica on the audit
guest). Kernel trigger hardware-gated (no AMD GPU — 0 PCI 0x1002 devices) and —
importantly — caller-gated/latent: no in-tree caller of `dc_interrupt_set()`/
`dc_interrupt_ack()` passes a `DC_IRQ_SOURCE_DC*_VLINE0` source on a dce110
service today. The defect is proven; the panic requires a future/alternate
caller.**

## The defect

`enum dc_irq_source` (`sys/dev/drm/amd/display/dc/irq_types.h:40-148`) runs to
`DAL_IRQ_SOURCES_NUMBER = 90` and includes `DC_IRQ_SOURCE_DC1_VLINE0 ..
DC_IRQ_SOURCE_DC6_VLINE0` = **84..89** (VBLANK1..6 = 78..83).

`irq_source_info_dce110[DAL_IRQ_SOURCES_NUMBER]`
(`irq_service_dce110.c:226-313`) is initialized with designated initializers
covering exactly enum values 0..83 (INVALID, HPD, HPDRX, I2C_DDC, DPSINK,
TIMER, PFLIP, PFLIP_UNDERLAY0, GPIOPAD0-30, DC1-6UNDERFLOW, DMCU_SCP, VBIOS_SW,
VUPDATE1-6, VBLANK1-6). **Entries 84..89 (the VLINE0 block) receive no
initializer** — they stay zero: `enable_reg=0 … .funcs=NULL`.

The generic dispatch only bounds-checks the index:

- `find_irq_source_info()` — `irq_service.c:82`:
  `if (source >= DAL_IRQ_SOURCES_NUMBER || source < DC_IRQ_SOURCE_INVALID)
  return NULL;` — 84..89 pass.
- `dal_irq_service_ack()` — `irq_service.c:152`:
  `if (info->funcs->ack) …` — reads `*(NULL + offsetof(ack))` ⇒ fault.
- `dal_irq_service_set()` — `irq_service.c:116,118`: acks first (same deref),
  then `if (info->funcs->set)`.

This is the same NULL-funcs-dispatch shape as the reproduced DF-4713 family
(amdgpu_irq.c), here rooted in this file's incomplete table rather than an
unregistered DRM-level source.

## Reachability audit (why "latent")

Every in-tree path into the service was traced:

- `dc_interrupt_set/ack` (`core/dc.c:1681-1693`) do no source validation beyond
  the generic index check.
- Callers: `dm_irq_state` (amdgpu_dm_irq.c:520-556) passes
  `IRQ_TYPE_PFLIP/IRQ_TYPE_VBLANK + acrtc->otg_inst` with `otg_inst` from
  `status->primary_otg_inst = pipe_ctx->stream_res.tg->inst`
  (amdgpu_dm.c:4856, dc_resource.c:2055) — hardware-bounded 0..5 on dce110;
  `amdgpu_dm_hpd_init/fini` pass `dc_link->irq_source_hpd{,_rx}` (HPD/HPDRX);
  `amdgpu_dm.c:3014` passes `IRQ_TYPE_VBLANK + otg_inst` (same bound).
- The interrupt *arrival* path (`amdgpu_dm_irq_handler` →
  `dc_interrupt_to_irq_source` → `to_dal_irq_source_dce110`) can only return
  {INVALID, VBLANK1-6, VUPDATE1-6, PFLIP1-6, HPD1-6, HPD RX1-6} — all covered;
  INVALID maps to the dummy entry.

So nothing passes 84..89 into a dce110 service in this tree. The gap becomes a
panic the moment any code (a DCN-port, a DM change, or
`DAL_VALID_IRQ_SRC_NUM`'s own off-by-one — `irq_types.h:158` allows
`src == DAL_IRQ_SOURCES_NUMBER`, see notes) starts forwarding VLINE0 or
edge-of-enum sources. dce120/dce80 tables have the identical shape (context
note for the maintainers).

## Reproduction (run.log / run.2.log, audit guest, cc 8.3)

- Table walk: exactly `table[84] … table[89] (.funcs == NULL)`; 6 gaps.
- Control: index 90 rejected; `PFLIP1` enable works via the generic RMW path.
- Trigger: `dal_irq_service_set(DC_IRQ_SOURCE_DC1_VLINE0=84)` crashes inside
  `dal_irq_service_ack` at the `info->funcs->ack` load — SIGSEGV exit 139,
  identical across two runs.
- Fixed: dummy entries + `!info->funcs` guards → `dal_irq_service_dummy_ack/set`
  log and return false; exit 0.

## Impact ceiling

A NULL-dereference in kernel context ⇒ hard panic (local DoS) on the machine
owning the display. No write primitive, no info leak, no escalation chain. Not
triggerable by an unprivileged local user through any existing path.

## Fix validation

`fix.diff` = six `dummy_irq_entry()` rows for `DC_IRQ_SOURCE_DC{1..6}_VLINE0` in
the dce110 table + `if (!info->funcs) {DC_LOG_ERROR; return false;}` guards in
`dal_irq_service_set`/`dal_irq_service_ack` (protects every asic table against
any future gap, incl. dce120/dce80). Applied to the guest's `/usr/src` together
with DF-4933's diff (patched md5s `724635b5…`/`305f0881…` vs pristine
`95266b5b…`/`35607b1a…` — the first build attempt accidentally skipped the
irq_service.c hunks (interactive patch on an already-patched tree); redone from
pristine with both files verified patched *at build time*). `amdgpu.ko` rebuilt
under `-Werror`: RC=0, zero errors, `irq_service.o irq_service_dce110.o` linked
(`amdgpu_module_build.log`). Harness fixed mode: no crash, graceful dummy
handling. Guest sources reverted md5-verified pristine.

## Fix status (batch validation)
Applied with the 36 sibling fix.diffs of this batch in findings/poc/_batch41/all_fixes.patch; single in-guest `make -j6 nativekernel KERNCONF=X86_64_GENERIC` completed RC=0 with zero errors under -Werror (full log: findings/poc/_batch41/fix_build8.log). Behavior A/B intentionally skipped for this Info-tier item.