{
  "finding_id": "DF-5079",
  "file": "sys/dev/drm/amd/display/dc/irq/dce120/irq_service_dce120.c",
  "title": "dce120 vupdate entries carry no .src_id, so dce110_vblank_set (wired by dce120's own vblank_irq_info_funcs) re-derives DC_IRQ_SOURCE_INVALID and underflows pipe_offset to 178 -> far-OOB pipe_ctx[178] read feeding a wild arm_vert_intr indirect call — the DF-4933/DF-5055 twin on the DCE120 table wiring",
  "verdict": "reproduced (logic-level replica, family standard): vupdate src_id=0 -> pipe_ctx[178] -> SIGBUS exit=138 x2; VBLANK1..6 controls healthy; fixed arms pipes 0..5 for all 12 sources, exit=0; amdgpu.ko fix build rc=0 0/0 -Werror",
  "impact": "panic (latent: no in-tree caller .set's a VUPDATE source; no AMD GPU on guest)",
  "reproduce": {
    "build": "sh /root/df5079/build.sh",
    "run": "sh /root/df5079/run.sh",
    "expected": "baseline: controls arm pipes 0..5, then set(VUPDATE1) -> pipe_offset 178 -> SIGBUS exit=138; fixed: exit=0"
  },
  "kernel_refs": ["sys/dev/drm/amd/display/dc/irq/dce120/irq_service_dce120.c:138", "sys/dev/drm/amd/display/dc/irq/dce110/irq_service_dce110.c:205", "sys/dev/drm/amd/display/dc/irq/dce110/irq_service_dce110.c:208", "sys/dev/drm/amd/display/dc/irq_types.h:153"],
  "artifacts": ["dce120_vupd.c", "build.sh", "run.sh", "build.log", "run.log", "run.2.log", "dmesg.txt", "fix.diff", "amdgpu_module_build.log", "fix_build.log", "fix_run.log", "env.txt", "VERDICT.md", "README.md", "verdict.json", "manifest.json"]
}