{
  "finding_id": "DF-4944",
  "status": "reproduced",
  "reproduced": 1,
  "impact": "none",
  "confidence": "certain",
  "verdict": "id_to_offsets GPIO_ID_GPIO_PAD branch (hw_translate_dce80.c:378-382) validates the derived mask (1<<en) against the pin-index bound GPIO_GPIO_PAD_MAX(30) instead of validating en: valid pads 5..30 are wrongly rejected and invalid en>=32 hits the C11 6.5.7 UB shift and is accepted with a degenerate mask (proved mask==0 accepted on the guests gcc 8.3/x86-64 \u2014 run.log T4). Both halves executed on the DF guest with the verbatim function copy. Impact is Info-class only because the sole caller, dal_gpio_get_pin_info (gpio_base.c:140-147), has no callers in the tree and GPIO_PAD pins cannot be opened (no case in dal_gpio_service_open, gpio_service.c:243-274) \u2014 a proven, latent logic/UB defect.",
  "exploit_chain": "",
  "evidence": "run.log T4: en=5/en=30 (VALID) rejected; en=32/en=64 (INVALID) accepted via UB with mask=0x0; fixrun.log T4 after fix.diff: en=5 mask=0x20 and en=30 mask=0x40000000 accepted, en=32/64 rejected.",
  "kernel_refs": [
    "sys/dev/drm/amd/display/dc/gpio/dce80/hw_translate_dce80.c:378",
    "sys/dev/drm/amd/display/include/gpio_types.h:156",
    "sys/dev/drm/amd/display/dc/gpio/gpio_base.c:140",
    "sys/dev/drm/amd/display/dc/gpio/gpio_service.c:243"
  ],
  "poc_changes": "n/a \u2014 fresh harness (verbatim function copy, real constants).",
  "attempts": 1,
  "guest_uname": "DragonFly dfbsd 6.5-DEVELOPMENT DragonFly 6.5-DEVELOPMENT #0: Thu Jul  2 06:02:54 UTC 2026 root@dfbsd:/usr/obj/usr/src/sys/X86_64_GENERIC x86_64",
  "runtime_sec": 5,
  "guest_dirty": 0,
  "build_cmd": "gcc -O2 -Wall -Wextra -o harness_dce80 harness_dce80.c",
  "run_cmd": "./harness_dce80",
  "code_hash": "8df7d21c82ff5c569875602af619df7050af7a55a26992ab957c8f557669120c",
  "fix_status": "validated",
  "fix_baseline_reproduced": 1,
  "fix_patched_reproduced": 0,
  "fix_verdict": "fix.diff replaces the mask comparison with an index comparison before shifting (result = (en <= GPIO_GPIO_PAD_MAX); if (result) info->mask = (1 << en)): harness_fixed shows pads 5..30 accepted with correct masks and en>=32 rejected, 0 regressions (fixrun.log T4).",
  "fix_evidence": "fixrun.log T4 section (four lines listed in README); fix.diff hunk 2 of the dce80 file.",
  "notes": "Latent (dead API today); filed as hardening with executed proof of both the over-restriction and the UB acceptance. dce120 copy has no GPIO_PAD branch at all, so no sibling there.",
  "recommended_fix": "Validate the pin index (en <= GPIO_GPIO_PAD_MAX) before computing info->mask = (1 << en)."
}