{
  "finding_id": "DF-4947",
  "status": "reproduced",
  "reproduced": 1,
  "impact": "none",
  "confidence": "certain",
  "verdict": "id_to_offsets GPIO_ID_DDC_DATA branch (hw_translate_dcn10.c:211-212) hardwires info->mask to the DDC6DATA bit-8 layout (0x100) for every DDC line, including GPIO_DDC_LINE_I2C_PAD (235-237). The I2C pad register DC_GPIO_I2CPAD_A exposes its data line (SDA) at bit 1 (0x2, dcn_1_0_sh_mask.h:41216-41219), and the factorys own ddc_i2c_data_regs entry for this pin uses that SDA_A_MASK (ddc_regs.h:66-71) \u2014 the translate and factory tables disagree, so the translate path would drive/read the wrong GPIO bit. Demonstrated deterministically on the DF guest with verbatim function copies and real DCN10 constants: run.log shows exactly one WRONG BIT line (mask=0x100 vs real 0x2); DDC1-6/VGA (identical layout) and the SCL clock mask are coincidentally correct. The sole in-tree consumer, dal_gpio_get_pin_info (gpio_base.c:140-147), has no callers today, so the defect is latent \u2014 Info severity, matching the DF-4944 family precedent.",
  "exploit_chain": "",
  "evidence": "run.log line id_to_offset(DDC_DATA, I2C_PAD) = true offset=0x5dc1 mask=0x100 real field mask=0x2 WRONG BIT (DF-4947) plus the three OK lines proving the DDC6 layout masks are correct for DDC1-6/VGA/SCL; DF-4946/run.log FIXED T3 shows the fixed model selecting mask=0x2 CORRECT.",
  "kernel_refs": [
    "sys/dev/drm/amd/display/dc/gpio/dcn10/hw_translate_dcn10.c:211",
    "sys/dev/drm/amd/display/dc/gpio/dcn10/hw_translate_dcn10.c:235",
    "sys/dev/drm/amd/display/dc/gpio/ddc_regs.h:66",
    "sys/dev/drm/amd/display/dc/gpio/gpio_base.c:140"
  ],
  "poc_changes": "n/a \u2014 fresh self-contained harness (verbatim DDC branches of the dcn10 id_to_offset, real DCN10 constants).",
  "attempts": 1,
  "guest_uname": "DragonFly dfbsd 6.5-DEVELOPMENT DragonFly 6.5-DEVELOPMENT #0: Thu Jul  2 06:02:54 UTC 2026     root@dfbsd:/usr/obj/usr/src/sys/X86_64_GENERIC  x86_64",
  "runtime_sec": 4,
  "guest_dirty": 0,
  "build_cmd": "gcc -O2 -Wall -Wextra -o harness_mask harness_mask.c",
  "run_cmd": "./harness_mask",
  "code_hash": "cd689e3935d448dc3645799141ea36b61543e7cba2df710b756242bd76ef6911",
  "fix_status": "validated",
  "fix_baseline_reproduced": 1,
  "fix_patched_reproduced": 0,
  "fix_verdict": "fix.diff moves the mask selection into the per-line switch and selects DC_GPIO_I2CPAD_A__DC_GPIO_SDA_A_MASK (0x2) for the I2C pad data line; the identical edit is modeled in DF-4946s harness_fixed.c which reports mask=0x2 CORRECT with 0 residual violations. No in-tree consumer exists today, so the patched-behavior demonstration is the unit model (family precedent DF-4944).",
  "fix_evidence": "fix.diff (per-line mask hunks for hw_translate_dcn10.c); DF-4946/run.log FIXED T3: I2C_PAD data mask is now the real SDA field ... CORRECT.",
  "notes": "Sibling of DF-4944 (dce80) in the DCN10 translation unit. DDC1-6/VGA masks are layout-identical to DDC6 (verified against dcn_1_0_sh_mask.h) \u2014 only the I2C pad data line is wrong; the SCL clock line (0x1) is correct by coincidence.",
  "recommended_fix": "Select the mask per DDC line in id_to_offset; use DC_GPIO_I2CPAD_A__DC_GPIO_SDA_A_MASK for GPIO_DDC_LINE_I2C_PAD under GPIO_ID_DDC_DATA."
}