# DF-4946 — DCN10 `offset_to_id` returns success on all DDC-family offsets without writing `*id`

**File:** `sys/dev/drm/amd/display/dc/gpio/dcn10/hw_translate_dcn10.c:165-189`
**Family:** DF-4943 (dce80) / DF-4945 (dce120) — this is the DCN10 (Raven) twin.
**Severity:** Low (memcorrupt bucket) · **CWE-457**

## Build

```
gcc -O2 -Wall -Wextra -o harness_dcn10 harness_dcn10.c
gcc -O2 -Wall -Wextra -o harness_fixed harness_fixed.c
gcc -O2 -Wall -Wextra -o harness_mask harness_mask.c   # DF-4947 side-car
```

## Run

```
./harness_dcn10
```

## Expected

All eight DDC-family register offsets (`REG(DC_GPIO_DDC{1..6}_A)` = 0x5d91..0x5da5,
`REG(DC_GPIO_DDCVGA_A)` = 0x5da9, `REG(DC_GPIO_I2CPAD_A)` = 0x5dc1) return `true`
after writing only `*en` — `*id` is left untouched (sprayed 0x7b7b7b7b survives).
`en=6` (DDC_VGA) and `en=7` (I2C_PAD) exceed the 6-entry `hpd_regs[]` of
`hw_factory_dcn10.c:71-78`, so a garbage `id == GPIO_ID_HPD(3)` decodes into
`define_hpd_registers` → `&hpd_regs[6..7]` OOB const-array read whose garbage
register descriptors then drive MMIO. `harness_fixed` applies the fix
(`*id = GPIO_ID_DDC_DATA` in every DDC branch) and reports 0 residual violations.

The kernel stage needs a Raven-class ASIC + crafted VBIOS gpio_pin_lut entry
(absent in QEMU — 0 AMD devices, env.txt); the deterministic contract violation
is proven at unit level with the verbatim function and real DCN10 constants.