{
  "finding_id": "DF-5036",
  "status": "untested",
  "reproduced": false,
  "impact": "none",
  "confidence": "certain",
  "verdict": "dal_i2caux_dce110_construct() is the shared engine factory for dce100/dce110/dce112/dce120/dcn10, taking the loop bound num_i2caux_inst (and the register tables) as caller parameters while indexing two callee-static 6-entry tables hw_ddc_lines[]/hw_aux_lines[] (i2caux_dce110.c:127-143) at :232/:279 and storing through base->i2c_hw_engines[line_id]/base->aux_engines[line_id] at :254/:288. Nothing relates num_i2caux_inst to ARRAY_SIZE(hw_ddc_lines). All five in-tree callers today pass exactly 6, so no overrun exists in-tree; a future ASIC passing a larger count (natural, since its register tables legitimately grow) reads a garbage line_id from adjacent rodata and writes past the GPIO_DDC_LINE_COUNT(8)-sized engine arrays in the heap object. Filed as latent hardening (Info) because the identical ownership mismatch already produced a real KLD-proven High in this family (DF-4827, dce_i2c_sw.c). Untested: no in-tree trigger, and the construct path needs an AMD ASIC absent from the guest.",
  "exploit_chain": "",
  "evidence": "README.md and VERDICT.md; run ./analysis.sh \u2014 prints the static line tables, the loops that index them with the caller count, and mechanically counts aux_regs/hw_engine_regs entries per sibling (all 6/6) plus each callers ARRAY_SIZE(...) bound.",
  "kernel_refs": [
    "sys/dev/drm/amd/display/dc/i2caux/dce110/i2caux_dce110.c:127",
    "sys/dev/drm/amd/display/dc/i2caux/dce110/i2caux_dce110.c:232",
    "sys/dev/drm/amd/display/dc/i2caux/dce110/i2caux_dce110.c:254",
    "sys/dev/drm/amd/display/dc/i2caux/dce110/i2caux_dce110.c:279",
    "sys/dev/drm/amd/display/dc/i2caux/dce110/i2caux_dce110.c:288",
    "sys/dev/drm/amd/display/dc/i2caux/dcn10/i2caux_dcn10.c:114"
  ],
  "poc_changes": "No PoC written \u2014 latent API-contract defect with zero in-tree triggers; evidence is a mechanical source-print/count script.",
  "attempts": 0,
  "guest_uname": "DragonFly dfbsd 6.5-DEVELOPMENT DragonFly 6.5-DEVELOPMENT #0: Thu Jul 2 06:02:54 UTC 2026 root@dfbsd:/usr/obj/usr/src/sys/X86_64_GENERIC x86_64",
  "runtime_sec": 0,
  "guest_dirty": 0,
  "build_cmd": "",
  "run_cmd": "",
  "code_hash": "",
  "notes": "Pattern precedent: DF-4827 (High, KLD-proven) \u2014 the sibling dce_i2c OOB where a line was validated against COUNT(8) but indexed a MAX_PIPES(6) array. Fix is a two-line clamp (or pass the line tables as parameters to restore symmetric ownership). All five callers verified 6/6/6 in this tree.",
  "recommended_fix": "Clamp num_i2caux_inst to ARRAY_SIZE(hw_ddc_lines) at the top of dal_i2caux_dce110_construct \u2014 see fix.diff.",
  "fix_status": "not_testable",
  "fix_baseline_reproduced": false,
  "fix_patched_reproduced": false,
  "fix_verdict": "n/a \u2014 latent defect, no in-tree trigger; clamp is a no-op for all five current callers (verified by reading each siblings table sizes).",
  "fix_evidence": "fix.diff (ARRAY_SIZE clamp at function entry)."
}