{
  "finding_id": "DF-5055",
  "verdict": "reproduced",
  "impact": "panic",
  "confidence": "certain",
  "root_cause": "irq_service_dce80.c's vupdate_int_entry (dce80:132-146) initializes no .src_id/.ext_id yet wires .funcs = &vblank_irq_info_funcs whose .set is dce110_vblank_set (dce80:82-85,:145); dce110_vblank_set (irq_service_dce110.c:195-219) re-derives the source from (0,0) -> to_dal_irq_source_dce110 default -> DC_IRQ_SOURCE_INVALID, and `uint8_t pipe_offset = dal_irq_src - IRQ_TYPE_VBLANK' underflows to 178; core_dc->current_state->res_ctx.pipe_ctx[178] is a far-OOB read on the MAX_PIPES(6) array whose garbage tg is immediately called through tg->funcs->arm_vert_intr(tg,2) — the DF-4933 twin wired independently by the DCE80 table macros",
  "kernel_refs": [
    "sys/dev/drm/amd/display/dc/irq/dce80/irq_service_dce80.c:82",
    "sys/dev/drm/amd/display/dc/irq/dce80/irq_service_dce80.c:132",
    "sys/dev/drm/amd/display/dc/irq/dce80/irq_service_dce80.c:145",
    "sys/dev/drm/amd/display/dc/irq/dce80/irq_service_dce80.c:162",
    "sys/dev/drm/amd/display/dc/irq/dce110/irq_service_dce110.c:195",
    "sys/dev/drm/amd/display/dc/irq/dce110/irq_service_dce110.c:205",
    "sys/dev/drm/amd/display/dc/irq/dce110/irq_service_dce110.c:207",
    "sys/dev/drm/amd/display/dc/irq_types.h:154",
    "sys/dev/drm/amd/include/ivsrcid/ivsrcid_vislands30.h:30"
  ],
  "reproduce": {
    "build": "sh build.sh   # cc -O2 -Wall -std=gnu11 [-DFIX_DF5055] on the audit guest",
    "run": "sh run.sh      # baseline then fixed",
    "expected": "baseline: 'table: vupdate1 src_id=0 ext_id=0 | vblank1 src_id=19'; VBLANK1..6 controls arm pipes 0..5 (in-tree path fine); then dal_irq_service_set(DC_IRQ_SOURCE_VUPDATE1) computes pipe_offset=(uint8_t)(0-78)=178, reads pipe_ctx[178] out of the 0x5a-poisoned mapping and calls tg->funcs->arm_vert_intr -> SIGBUS exit 138 (deterministic x2, run.log incl. second run). fixed (index-derived pipe_offset): all 12 VUPDATE/VBLANK sources arm pipes 0..5, exit 0; plus full -Werror amdgpu.ko rebuild with the fix RC=0 (amdgpu_module_build.log)."
  },
  "artifacts": [
    "README.md", "VERDICT.md", "dce80_vupd.c", "build.sh", "run.sh",
    "build.log", "run.log", "env.txt",
    "fix.diff", "amd_fix_apply.log", "amdgpu_module_build.log",
    "manifest.json", "verdict.json"
  ]
}