# DF-5078 VERDICT — dce120 VLINE0 table gap (NULL .funcs dispatch), replica-reproduced

**Status: reproduced (logic level, family-standard replica), impact panic,
confidence certain.** Same methodology and ceiling as DF-4932 (dce110),
DF-4995 (dcn10), DF-5054 (dce80) — the DCE120 instance of the family,
noted for maintainers in DF-4932's verdict and now filed per-file ("each
asic table is its own code").

## Root cause (code-certain)

`irq_source_info_dce120[DAL_IRQ_SOURCES_NUMBER]` (irq_service_dce120.c:177-263)
designators cover exactly enum sources **0..83**:

    INVALID(0); HPD1+0..5(1..6); HPD1RX+0..5(7..12); I2C_DDC1..6(13..18);
    DPSINK1..6(19..24); TIMER(25); PFLIP1+0..5(26..31); PFLIP_UNDERLAY0(32);
    GPIOPAD0..30(33..63); DC1..6UNDERFLOW(64..69); DMCU_SCP(70); VBIOS_SW(71);
    VUPDATE1+0..5(72..77); VBLANK1+0..5(78..83)

The shared enum (irq_types.h:40-148) continues to
`DC_IRQ_SOURCE_DC{1..6}_LINE0` = **84..89** < `DAL_IRQ_SOURCES_NUMBER`=90 —
those six entries stay zero-initialized, `.funcs == NULL`.
`find_irq_source_info` (irq_service.c:77-86) bounds-checks ONLY the index, so
`dal_irq_service_ack` (:152 — invoked FIRST by `dal_irq_service_set` at :116)
dereferences `info->funcs->ack` on NULL, and `dal_irq_service_set` (:118)
`info->funcs->set` — a read at page-0 offset ~40 ⇒ kernel page fault/panic.
DF-2168/DF-4713 is the hub-level family root; this is the dce120 table's own
completeness gap.

## Reproduction (this run, on the audit guest)

Verbatim userland replica of the dce120 entry macros + FULL table body +
dce120 hpd_ack + dummy funcs + dce110_vblank_set + to_dal_irq_source_dce110
+ the irq_service.c:77-158 dispatch (see dce120_vline0gap.c header for the
path:line map). Results (run.log, run.2.log — deterministic x2):

* static audit: `NULL-funcs entries: 84 85 86 87 88 89 (6 NULL-funcs slots)`
* controls: ack(90) rejected; set(PFLIP1) generic path ok; dce120 hpd_ack
  polarity toggle ok; VBLANK1..6 arm pipes 0..5 through the real conversion;
  to_dal sweep (256 src x 13 ext incl. 0xdead): **0 returns in 84..89**
* trigger-child `ack(84)`: `info->funcs == 0x0` → **signal 11**
* trigger-main `set(84)`: **Segmentation fault, exit 139**
* fixed mode (six dummy entries = fix.diff): 0 NULL-funcs, dummy handlers
  log-and-return, **exit 0**

Kernel console corroborates the faults on the guest (dmesg.txt: four
`pid ... (dce120_vline0gap) ... exited on signal 11` lines per run).

## Reachability (traced honestly — latent)

* IH arrival: `amdgpu_dm_irq_handler` (amdgpu_dm_irq.c:477-487) converts via
  `to_dal_irq_source_dce110` — can only return covered sources or INVALID
  (dummy entry), never 84..89 (sweep above).
* `dm_irq_state` (amdgpu_dm_irq.c:535-556): IRQ_TYPE_PFLIP/IRQ_TYPE_VBLANK +
  `acrtc->otg_inst` (hardware-bounded 0..5) → 26..31 / 78..83.
* HPD init/fini (amdgpu_dm_irq.c:625-645, 515-527): HPD/HPDRX only.
* `amdgpu_dm.c:3014`: `IRQ_TYPE_VBLANK + acrtc->otg_inst`.
* The service exists only on DCE12 (Vega10/12) hardware
  (dce120_resource.c:1011); guest has **0** AMD PCI devices.

⇒ No unprivileged trigger exists today; the panic is one future caller away
(a DM change using VLINE0 on DCE12, or any caller gating on the
`DAL_VALID_IRQ_SRC_NUM` off-by-one at irq_types.h:157-158, which admits
`src == DAL_IRQ_SOURCES_NUMBER`).

## Ceiling

NULL-page read at a fixed small offset ⇒ hard kernel panic (local DoS).
No write primitive, no leak. Severity Low (family-consistent).

## Fix validation

fix.diff = six `[DC_IRQ_SOURCE_DCx_VLINE0] = dummy_irq_entry()` designators
completing the table over the shared enum (DF-4932/DF-4995/DF-5054's exact
per-asic shape). Applied to guest /usr/src together with DF-5079's diff:
`patch -V none -p1`, hunk #1 succeeded at :260; full `make -j6` amdgpu.ko
rebuild **rc=0, 0 `error:` / 0 `warning:` under -Werror**
(amdgpu_module_build.log 777 lines; irq_service_dce120.c compiled at :574);
replica fixed mode exit 0; sources reverted md5-verified pristine
(51bd6ea8...), `make clean`. Guest returned to clean snapshot afterwards.

## Artifacts

dce120_vline0gap.c (code_hash d196028e...), build.log, run.log, run.2.log,
dmesg.txt, env.txt, fix.diff, amdgpu_module_build.log, fix_build.log,
fix_run.log, manifest.json, verdict.json.

## Fix status (batch validation)
Applied with the 36 sibling fix.diffs of this batch in findings/poc/_batch41/all_fixes.patch; single in-guest `make -j6 nativekernel KERNCONF=X86_64_GENERIC` completed RC=0 with zero errors under -Werror (full log: findings/poc/_batch41/fix_build8.log). Behavior A/B intentionally skipped for this Info-tier item.