# DF-4945 — hw_translate_dce120.c: offset_to_id returns success for DDC-family offsets without writing *id (DCE12 copy of DF-4943)

File audited (pass 2): `sys/dev/drm/amd/display/dc/gpio/dce120/hw_translate_dce120.c`
Lines: 165-189. Consumer: `gpio_service.c:143-157`.

## What to run

```
./build.sh && ./run.sh     # harness_dce120.c (run.log)
```

harness_dce120.c is a verbatim copy of the DCE12 `offset_to_id`
(hw_translate_dce120.c:61-201) with the real DCE12/Vega10 constants:
`REG(x) = DCE_BASE__INST0_SEG2(0x34C0) + mm x` (vega10_ip_offset.h:277,
all DC_GPIO regs BASE_IDX 2) — exactly the full-offset domain the VBIOS
`gpio_pin_lut.data_a_reg_index` stores (bios_parser2.c:537-539), e.g.
`REG(DC_GPIO_DDC1_A)=0x55a7`.

## Expected (reproduced on the DF 6.5-DEVELOPMENT guest)

```
offset_to_id(REG(DDCVGA),0x100) = true en=6(id==0x7b7b7b7b UNTOUCHED)
  -> BUG(DF-4945): success, *id never written; garbage id==GPIO_ID_HPD(3)
     => dal_gpio_create(HPD, en=6) with en>=6 indexes hpd_regs[6] OOB
offset_to_id(REG(I2CPAD),0x1)    = true en=7(id==0x7b7b7b7b UNTOUCHED)
  -> BUG(DF-4945): en=7 >= hpd_regs[6]: garbage-id==HPD path is OOB
```

## Kernel chain (code trace)

1. VBIOS `gpio_pin_lut v2.1` entry (`data_a_reg_index` = a DCE12 DDC-family
   full offset — bios_parser2.c:537-539) for a connector's HPD pin →
   `get_hpd_gpio` (dc_link.c:115-118) → `dal_gpio_service_create_irq`.
2. `gpio_service.c:148-151`: `id` uninitialized; `offset_to_id` returns true
   having written only `*en` (hw_translate_dce120.c:165-189).
3. Garbage `id == GPIO_ID_HPD(3)` → `dal_gpio_create(HPD, en∈{0..7})` →
   `dal_gpio_service_open` → `define_hpd_registers(pin, en)`
   → `hpd_regs[6..7]` **OOB** (`hpd_regs[]` has 6 entries,
   hw_factory_dce120.c:76-83,158) → `REG_GET(int_status)` /
   `REG_UPDATE_2(toggle_filt_cntl)` MMIO from garbage descriptors
   (hw_hpd.c:89,110). DDC-line values 6/7 (DDC_VGA / I2C_PAD) are the OOB
   producers; values 0..5 alias valid HPD pins (wrong-pin programming).

## DCE120-specific notes

- No `mmGPIOPAD_A` case exists in the DCE12 reverse map (verified: harness T2
  rejects 0x183) and no `GPIO_ID_GPIO_PAD` case in `id_to_offset` — the
  deterministic GPIOPAD→DDC OOB producer (DF-4942) does **not** exist on
  dce120; only the uninit-`*id` defect does.
- The `REG()` base arithmetic (SEG2=0x34C0) matches the VBIOS full-offset
  domain — the switch constants are correct (negative result).

## After fix.diff

The dce120 hunks set `*id = GPIO_ID_DDC_DATA` in all 8 DDC-family branches
plus the `dal_gpio_create_ddc` consumer guard — structurally eliminating the
uninitialized id on this family as well.

## Impact ceiling

Same as DF-4943 (Low): crafted VBIOS + stack-garbage==HPD; worst case OOB
rodata read → wild MMIO → panic at driver attach on Vega10-class ASICs.