{
  "finding_id": "DF-4962",
  "status": "reproduced",
  "attempts": 1,
  "reproduced": 1,
  "impact": "infoleak",
  "confidence": "certain",
  "verdict": "Live-demonstrated during the DF-4961 fix-validation run (findings/poc/DF-4961/run.2.log: the failure branch executed 4x with the uninitialized val printed as the second %02x): amdgpu_i2c_get_byte leaves *val untouched unless i2c_transfer()==2, and both router-select helpers declare u8 val uninitialized then compute/print it - on DFs compat stub the failure branch is taken on EVERY call, so a garbage stack byte propagates into router-mux writes and debug logs. Minor info disclosure into dmesg + wrong mux state. *val=0-before-transfer fix.",
  "exploit_chain": "bit i2c (always-fail on DF stub) -> *val untouched -> val &= ~pin | state -> written to router + printed",
  "evidence": "findings/poc/DF-4962/ (this verdict; live log in the DF-4961 pack)",
  "kernel_refs": [
    "sys/dev/drm/amd/amdgpu/amdgpu_i2c.c:309-315",
    "sys/dev/drm/amd/amdgpu/amdgpu_i2c.c:341-366",
    "sys/dev/drm/amd/amdgpu/amdgpu_i2c.c:369-395"
  ],
  "guest_uname": "DragonFly dfbsd 6.5-DEVELOPMENT",
  "code_hash": ""
}