{"finding_id":"DF-4935","status":"untested","attempts":0,"reproduced":0,"impact":"none","confidence":"speculative","verdict":"Latent output-param contract violation (Info/speculative): the default branch ASSERTs without writing *atom_clock_type or clearing retCode - the function can return true with the output untouched, and the live consumer set_dce_clock_v2_1 declares the variable uninitialized and copies it into the VBIOS command. Unreachable today (the enum has exactly the two handled members, driver-internal source) - becomes a live uninit-stack-to-VBIOS feed the moment the enum is extended (DCN upstream added PIXELCLK for exactly this table). retCode=false-in-default fix.","exploit_chain":"none today (enum-closed)","evidence":"findings/poc/DF-4935/ (this verdict)","kernel_refs":["sys/dev/drm/amd/display/dc/bios/dce112/command_table_helper2_dce112.c:333-356","sys/dev/drm/amd/display/dc/bios/command_table2.c:714-727"],"guest_uname":"","code_hash":""}