{
  "finding_id": "DF-5035",
  "title": "Unsynchronized check-then-set of i2c_hw_buffer_in_use lets concurrent acquires share the single DCE11 DC_I2C HW engine (acquire-side twin of DF-4878)",
  "verdict": "untested",
  "impact": "none (ceiling on real HW: corrupted DDC/EDID transactions, display-detection DoS)",
  "severity": "Low",
  "reproduce": {
    "build": "n/a (no PoC — hardware-gated race)",
    "run": "sh analysis.sh",
    "expected": "Prints the racy check-then-set and release clear, the lock-free struct i2caux (with the dropped-DAL2-mutex comment), and the lock-free submit path."
  },
  "kernel_refs": [
    "sys/dev/drm/amd/display/dc/i2caux/dce110/i2caux_dce110.c:79-125",
    "sys/dev/drm/amd/display/dc/i2caux/i2caux.h:55-98",
    "sys/dev/drm/amd/display/dc/i2caux/i2caux.c:109-194"
  ],
  "artifacts": ["README.md", "VERDICT.md", "analysis.sh", "fix.diff", "verdict.json", "manifest.json"]
}