# DF-5075 evidence pack

## What
`sys/dev/drm/amd/display/dc/bios/command_table_helper.c` — the v1 DC BIOS
command-table helper hub leaves `*h` NULL (returns false, value ignored) for
`DCE_VERSION_12_0` / `DCN_VERSION_1_0` / `DCN_VERSION_1_01` / `UNKNOWN`, while
the legacy-parser fallback (old-format VBIOS header on DCE12/DCN silicon) can
still construct parser1 on exactly those ASICs. Every BIOS command then calls
through a NULL vtable pointer (`bp->cmd_helper->…`, e.g. command_table.c:204)
→ kernel page-fault panic at display bring-up.

## Build / run (guest, unprivileged)
```
sh build.sh    # cc -O2 -Wall -o trigger_nullhelper trigger_nullhelper.c
sh run.sh      # expect: "[+] child died SIGSEGV ..." and exit=42
```
The harness is a **userspace semantics demo** of the defect chain
(kzalloc-NULL → ignored init failure → unguarded indirect call), not a kernel
PoC: the kernel path needs AMD DCE12/DCN silicon with a legacy-format VBIOS,
and the audit guest has no AMD GPU at all (env.txt).

## Expected output
```
[*] kzalloc'd bios_parser: bp->cmd_helper = 0x0 (NULL)
[*] init_cmd_tbl_helper(dce_version=1200) returned; return value ignored, cmd_helper = 0x0
[*] calling bp->cmd_helper->assign_control_parameter() (member at +0x20)...
[+] child died SIGSEGV at the indirect call through the NULL vtable -- semantics chain (1)-(4) confirmed
exit=42
```

## Contents
- `VERDICT.md` — full narrative, reachability chain, negative results, matrix
- `trigger_nullhelper.c` / `build.sh` / `run.sh` / `build.log` / `run.log`
- `env.txt` — guest evidence (uname, no AMD GPU, no class-0c:07 device)
- `fix.diff` — hub coverage + caller return-check; `git apply --check` verified
- `manifest.json`, `verdict.json`