{
  "finding_id": "DF-5159",
  "status": "untested",
  "reproduced": false,
  "impact": "none",
  "confidence": "certain",
  "verdict": "Code-level weakness established with certainty by inspection, but not demonstrable on the audit guest. Every range guard in bw_fixed.c is ASSERT(), which expands to WARN_ON (os_types.h:76) \u2014 advisory only in release kernels. Consequences: bw_int_to_fixed_nonconst (bw_fixed.c:53) silently shifts bits out for |value| >= 2^39; bw_frc_to_fixeds long-division loop (bw_fixed.c:84-93) wraps res_value mod 2^64 with only WARN at bw_fixed.c:76/100, and abs_i64(INT64_MIN) at bw_fixed.c:41-47 is signed-negation UB; bw_mul (bw_fixed.c:161) computes arg1_int*arg2_int with operands up to 2^39-1 (~2^78 product) \u2014 unconditional u64 wrap before the first assert even evaluates, and the later summand asserts (163/169/175/184) are WARN-only. The wrapped values feed DML watermark programming: wrong display config and WARN splats at worst \u2014 the file is pure arithmetic with no pointers, arrays or copies, so kernel memory unsafety is structurally impossible. The guest has no AMD DC GPU and no drm module loaded (env.txt), so there is no runtime entry point; rated Info hardening (CWE-190), distinct from known DF-2155 (div0 family, not re-reported).",
  "exploit_chain": "",
  "evidence": "VERDICT.md (per-function wrap analysis with path:line); os_types.h:76 (#define ASSERT(expr) WARN_ON(!(expr))) is the decisive fact that turns the assert-annotated math into silently-wrapping math in release builds; env.txt documents guest has no AMD DC hardware / drm modules => no runtime entry.",
  "kernel_refs": [
    "sys/dev/drm/amd/display/dc/calcs/bw_fixed.c:53",
    "sys/dev/drm/amd/display/dc/calcs/bw_fixed.c:41",
    "sys/dev/drm/amd/display/dc/calcs/bw_fixed.c:76",
    "sys/dev/drm/amd/display/dc/calcs/bw_fixed.c:86",
    "sys/dev/drm/amd/display/dc/calcs/bw_fixed.c:161",
    "sys/dev/drm/amd/display/dc/calcs/bw_fixed.c:163",
    "sys/dev/drm/amd/display/dc/os_types.h:76",
    "sys/dev/drm/amd/display/dc/inc/bw_fixed.h:40"
  ],
  "poc_changes": "No PoC exists: helpers are internal to the amdgpu DC module; the audit guest has no AMD DC GPU and no drm module loaded (env.txt), so the code has no reachable runtime entry on this machine.",
  "attempts": 0,
  "guest_uname": "DragonFly dfbsd 6.5-DEVELOPMENT DragonFly 6.5-DEVELOPMENT #0: Thu Jul  2 06:02:54 UTC 2026     root@dfbsd:/usr/obj/usr/src/sys/X86_64_GENERIC  x86_64",
  "runtime_sec": 0,
  "guest_dirty": 0,
  "build_cmd": "",
  "run_cmd": "",
  "code_hash": "",
  "notes": "Pass-2 finding, distinct from DF-2155 (div0s at bw_fixed.c:69/119/132 \u2014 not re-reported). Hunted and killed beyond it: floor2/ceil2 have no shifts (only div64_s64 + a multiplication bounded by |arg| \u2014 no new class beyond the known div0); no shift exceeds 63 anywhere (only <<24 and <<1 on u64); the file performs no memory access at all, so OOB/UAF/leak classes are structurally absent; bw_add/bw_sub silent wrap lives in bw_fixed.h:101-118 (different file, noted for the orchestrator, not filed here).",
  "recommended_fix": "Replace WARN-only ASSERTs with saturating clamps (or 64x64->128 multiply + range check before truncation) in bw_int_to_fixed_nonconst / bw_frc_to_fixed / bw_mul.",
  "fix_status": "not_testable",
  "fix_baseline_reproduced": 0,
  "fix_patched_reproduced": 0,
  "fix_verdict": "No fix.diff authored: changing DML arithmetic semantics (saturation behavior) has no validation target on this guest (no AMD DC hardware) and upstream amdgpu carries the same WARN-only pattern \u2014 an upstream decision is needed. Baseline was likewise not reproducible here.",
  "fix_evidence": "VERDICT.md Fix direction section documents why no diff is shipped for this Info hardening finding."
}