# DF-4944 VERDICT

**Status: reproduced (logic + UB acceptance executed on the DF guest); latent (no live callers).**

- Verbatim copy of `id_to_offset` executed on the guest: the GPIO_PAD branch
  at hw_translate_dce80.c:378-382 computes `info->mask = (1 << en)` and then
  compares **mask** against `GPIO_GPIO_PAD_MAX` (30) — an *index* bound
  (gpio_types.h:156). Result (run.log T4):
  - valid pads en=5, en=30 → **rejected** (masks 0x20/0x40000000 > 30);
  - invalid en=32, en=64 → **accepted** with `mask == 0x0` on gcc 8.3
    x86-64 (the `1 << en` UB manifests as 0; `0 <= 30` passes).
- Severity stays Info because the only route to this code is
  `dal_gpio_get_pin_info` (gpio_base.c:140-147), which has zero callers in
  sys/ (verified by tree-wide grep: definition + declaration only), and
  GPIO_PAD pins cannot be opened anyway (no `GPIO_ID_GPIO_PAD` case in
  `dal_gpio_service_open`, gpio_service.c:243-274). The defect is proven,
  not currently reachable — it is a loaded trap for the first future caller.
- Negative checks preserved by the fix: GPIOPAD *reverse-map* bounds
  (offset_to_id) are sound — 31/UNKNOWN(32)/multi-bit all rejected (T3);
  HPD forward-map rejects en>=6 (T5).
- fix.diff validates the index before shifting; harness_fixed confirms both
  halves corrected with 0 regressions (fixrun.log T4).

## Fix status (batch validation)
Applied with the 36 sibling fix.diffs of this batch in findings/poc/_batch41/all_fixes.patch; single in-guest `make -j6 nativekernel KERNCONF=X86_64_GENERIC` completed RC=0 with zero errors under -Werror (full log: findings/poc/_batch41/fix_build8.log). Behavior A/B intentionally skipped for this Info-tier item.