{
  "finding_id": "DF-4965",
  "status": "reproduced",
  "reproduced": 1,
  "impact": "dos",
  "confidence": "certain",
  "verdict": "The DCE110 copy of offset_to_id (hw_translate_dce110.c:143-167) has the family defect of DF-4943/DF-4945/DF-4946: all eight DDC-family branches (DDC1-0x4869..DDC6-0x487d, DDCVGA-0x4881, I2CPAD-0x4899) return true after writing only *en. dal_gpio_service_create_irq (gpio_service.c:148) then switches on the uninitialized id; garbage==GPIO_ID_HPD(3) with a DDC-line en of 6 (DDC_VGA) or 7 (I2C_PAD) reaches define_hpd_registers, which indexes the 6-entry hpd_regs[] (hw_factory_dce110.c:57-64,139,142) out of bounds -- garbage int_status/toggle_filt_cntl descriptors then drive MMIO (hw_hpd.c). Executed on the DF guest with a verbatim copy of the dce110 functions and real DCE11 absolute-offset constants (run.log: all 8 branches true with *id untouched at poison 0xA11CE0D5; GENERIC/HPD/SYNCA controls do write *id). Unlike dce80, dce110 has no mmGPIOPAD_A case (register not even defined in dce_11_0_d.h; T[GPIOPAD]=0x183->false) so the deterministic DF-4942 producer is absent, and no GPIO_ID_GPIO_PAD forward-map case (no DF-4944 twin) -- the uninit-id path is the only cross-domain route and is probabilistic. Kernel-stage execution requires a DCE110 ASIC (Tonga/Fiji/Carrizo) + crafted VBIOS (guest has none).",
  "exploit_chain": "crafted VBIOS GPIO_Pin_LUT (usGpioPin_AIndex = mmDC_GPIO_DDCVGA_A=0x4881 or mmDC_GPIO_I2CPAD_A=0x4899, bios_parser.c:1819-1826) -> get_hpd_gpio (dc_link.c:115-118) -> dal_gpio_service_create_irq -> offset_to_id true with id UNWRITTEN -> garbage id==GPIO_ID_HPD(3) -> dal_gpio_service_open(HPD, en=6/7) -> define_hpd_registers -> hpd_regs[6..7] OOB rodata read -> REG_UPDATE/REG_GET MMIO at garbage register descriptors -> panic/attach failure on DCE110 hardware. Probabilistic final stage.",
  "evidence": "run.log lines T[DDCVGA] offset_to_id(0x4881,0x100)=true en=6 id=<poison> <== id UNWRITTEN and T[I2CPAD] offset_to_id(0x4899,0x1)=true en=7 id=<poison> <== id UNWRITTEN; T[GPIOPAD] 0x183->false; fixrun.log: FIXED build writes id=DDC_DATA(0) in all 8 branches, controls unchanged.",
  "kernel_refs": [
    "sys/dev/drm/amd/display/dc/gpio/dce110/hw_translate_dce110.c:143",
    "sys/dev/drm/amd/display/dc/gpio/gpio_service.c:148",
    "sys/dev/drm/amd/display/dc/gpio/gpio_service.c:373",
    "sys/dev/drm/amd/display/dc/gpio/dce110/hw_factory_dce110.c:57",
    "sys/dev/drm/amd/display/dc/gpio/dce110/hw_factory_dce110.c:139",
    "sys/dev/drm/amd/display/dc/gpio/hw_hpd.c:89",
    "sys/dev/drm/amd/display/dc/core/dc_link.c:115",
    "sys/dev/drm/amd/display/dc/bios/bios_parser.c:1819"
  ],
  "poc_changes": "fresh harness (verbatim dce110 offset_to_id/id_to_offset copy, real DCE11 constants: absolute MMIO offsets from dce_11_0_d.h, field masks from dce_11_0_sh_mask.h, enums from gpio_types.h); fixed gcc-8 compile issue (enum gpio_sync needs HSYNC_B/VSYNC_B referenced by the verbatim body).",
  "attempts": 3,
  "guest_uname": "DragonFly dfbsd 6.5-DEVELOPMENT DragonFly 6.5-DEVELOPMENT #0: Thu Jul  2 06:02:54 UTC 2026 root@dfbsd:/usr/obj/usr/src/sys/X86_64_GENERIC x86_64",
  "runtime_sec": 8,
  "guest_dirty": 0,
  "build_cmd": "gcc -O2 -Wall -Wextra -o harness_dce110 harness_dce110.c && gcc -O2 -Wall -Wextra -DFIXED -o harness_fixed harness_dce110.c",
  "run_cmd": "./harness_dce110; ./harness_fixed",
  "code_hash": "41f57dc86d3f00b485a484d63b8ff35f389118260e2c9f0aefed4c5808d2ec0d",
  "fix_status": "validated",
  "fix_baseline_reproduced": 1,
  "fix_patched_reproduced": 0,
  "fix_verdict": "fix.diff adds *id = GPIO_ID_DDC_DATA to all eight DDC-family branches of the dce110 offset_to_id plus a consumer guard in dal_gpio_service_create_irq (id = GPIO_ID_UNKNOWN init + reject). The -DFIXED harness build applies exactly the 8-branch edit: fixrun.log shows id=DDC_DATA(0) on every DDC decode (poison eliminated) with zero regressions on the GENERIC/HPD/SYNCA/reject controls; with the fix dal_gpio_create_irq deterministically rejects DDC_DATA (default -> NULL) instead of switching on garbage. No AMD hardware on the guest, so kernel-build validation is impossible; harness-level validation only (same standard as the DF-4945 family).",
  "fix_evidence": "fix.diff (dce110 hunks + gpio_service.c create_irq guard); fixrun.log (fixed-build run, 8/8 branches write id, 0 regressions).",
  "notes": "4th member of the uninitialized-*id family (DF-4943 dce80, DF-4945 dce120, DF-4946 dcn10). Verified absent on dce110: mmGPIOPAD_A reverse-map (DF-4942 producer) and GPIO_ID_GPIO_PAD forward-map (DF-4944). ddc_data_regs/ddc_clk_regs sized 8 == DDC-line domain, in-bounds. Guest: no amdgpu module, no 0x1002 PCI device, /dev/dri absent.",
  "recommended_fix": "Write *id (GPIO_ID_DDC_DATA) in every successful DDC-family branch of dce110 offset_to_id and harden dal_gpio_service_create_irq against decoders that leave *id unwritten."
}