# DF-5079 — dce120 vupdate entries carry no `.src_id` → dce110_vblank_set pipe-offset underflow (pipe_ctx[178])

**File:** `sys/dev/drm/amd/display/dc/irq/dce120/irq_service_dce120.c:138-144`
(wired at :82-85 to `dce110_vblank_set`) — DF-4933 (dce110) / DF-5055 (dce80)
twin on the DCE120 table wiring.

## Build (on the guest)

```
mkdir -p /root/df5079 && cp dce120_vupd.c build.sh run.sh /root/df5079/
sh /root/df5079/build.sh
```

## Run (on the guest; run twice for determinism)

```
sh /root/df5079/run.sh     # -> run.log, run.2.log
```

## Expected

* **baseline** (`dce120_vupd_base`):
  * table check: vupdate1 `src_id=0 ext_id=0` (macro initializes none,
    unlike vblank's 19..24); the "double-baked" note prints — even a correct
    VUPDATE remap underflows: `(uint8_t)(VUPDATE1(72) − IRQ_TYPE_VBLANK(78)) = 250`;
  * controls: VBLANK1..6 arm pipes 0..5 through the REAL conversion path
    (to_dal maps the consecutive VLINE0 src ids 19..24 → VBLANK1..6);
  * trigger: `set(DC_IRQ_SOURCE_VUPDATE1)` → `to_dal_irq_source_dce110(0,0)`
    → `DC_IRQ_SOURCE_INVALID` → `uint8_t pipe_offset = 0 − 78` = **178** →
    `pipe_ctx[178]` far-OOB read on the MAX_PIPES=6 array (poisoned 0x5a
    mapping) → garbage `tg` → `tg->funcs->arm_vert_intr(tg,2)` wild indirect
    call → **SIGBUS exit 138**. Kernel equivalent: far-OOB read feeding a
    wild indirect call ⇒ panic; a groomed heap could in principle aim `tg`
    (not demonstrated — honest ceiling is a panic).
* **fixed** (`-DFIX_DF5079`, = fix.diff: pipe derived from the TABLE INDEX,
  provably 0..5 for both ranges + correct V_UPDATE src ids in the macro):
  all 12 VUPDATE/VBLANK sources arm pipes 0..5, **exit 0**.

Observed (guest, cc 8.3): baseline `exit=138` x2, fixed `exit=0` x2
(dmesg.txt corroborates: `pid ... (dce120_vupd_base) ... exited on signal 10`).

Fix validation: same combined amdgpu.ko rebuild as DF-5078 (rc=0, 0/0 under
-Werror; irq_service_dce110.c hunk = DF-4933/DF-5055's identical fix shape);
sources reverted md5-verified pristine; `make clean`.

Reachability is latent (traced in VERDICT.md) and the guest has no AMD GPU —
family-standard logic-level replica methodology.