{
  "finding_id": "DF-5163",
  "status": "not_reproduced",
  "reproduced": false,
  "impact": "none",
  "confidence": "likely",
  "verdict": "Structural data race, proven by inspection, not observable on this guest (virtio VGA; amdgpu never attaches \u2014 env.txt/run.log). amdgpu_atombios_i2c_process_i2c_ch() copies the received i2c bytes out of the shared atom fb scratch (atombios_i2c.c:103-104) after amdgpu_atom_execute_table() has already released ctx->mutex (atom.c:1278); amdgpus struct atom_context lacks the scratch_mutex that radeon added in 2015 to close exactly this window (radeon/atom.h:128, radeon/atom.c:1247-1252, radeon/atombios_i2c.c:51/99). Two concurrent atom-fb users on different hw_capable DDC buses (selected by default since amdgpu_hw_i2c==1, amdgpu_drv.c:88) interleave and deliver cross-contaminated/torn DDC data. Memory-safe (num<=255 vs >=20KiB kzallocd scratch) \u2014 impact ceiling is wrong EDID/DDC data, severity Info.",
  "exploit_chain": "thread A (DDC bus X) executes ProcessI2cChannelTransaction filling scratch with Xs reply; thread B (DDC bus Y) executes the same table overwriting scratch; thread As amdgpu_atombios_copy_swap (atombios_i2c.c:104) then returns Ys bytes as Xs i2c read -> misattributed/torn EDID on connector probing. No memory-corruption or disclosure step exists (bounded copy out of zero-initialized oversize scratch).",
  "evidence": "VERDICT.md (line-cited window + radeon fix references); run.log (guest: BUILD_OK, VGA is virtio, AMDGPU_NOT_LOADED); fix.diff (4-file scratch_mutex port, git apply --check clean)",
  "kernel_refs": [
    "sys/dev/drm/amd/amdgpu/atombios_i2c.c:52",
    "sys/dev/drm/amd/amdgpu/atombios_i2c.c:94",
    "sys/dev/drm/amd/amdgpu/atombios_i2c.c:103",
    "sys/dev/drm/amd/amdgpu/atom.c:1263",
    "sys/dev/drm/amd/amdgpu/atom.c:1278",
    "sys/dev/drm/amd/amdgpu/atom.h:128",
    "sys/dev/drm/amd/amdgpu/amdgpu_atombios.c:1814",
    "sys/dev/drm/amd/amdgpu/amdgpu_i2c.c:187",
    "sys/dev/drm/amd/amdgpu/amdgpu_drv.c:88",
    "sys/dev/drm/radeon/atom.h:128",
    "sys/dev/drm/radeon/atom.c:1247",
    "sys/dev/drm/radeon/atombios_i2c.c:51",
    "sys/dev/drm/amd/amdgpu/atombios_dp.c:114"
  ],
  "poc_changes": "no orchestrator seed existed; conceptual trigger sketch authored fresh (no userland driver for amdgpu internal DDC buses on DragonFly \u2014 race is kernel-internal)",
  "attempts": 1,
  "guest_uname": "DragonFly dfbsd 6.5-DEVELOPMENT DragonFly 6.5-DEVELOPMENT #0: Thu Jul  2 06:02:54 UTC 2026\troot@dfbsd:/usr/obj/usr/src/sys/X86_64_GENERIC  x86_64",
  "runtime_sec": 30,
  "guest_dirty": 0,
  "build_cmd": "cc -O2 -Wall -o ddc_race_sketch ddc_race_sketch.c",
  "run_cmd": "./run.sh (prints conceptual note; real exercise needs amdgpu h/w with 2 hw_capable DDC buses under concurrent probe)",
  "code_hash": "08b25d33d531894049c960e409415cdb6d67aa9f3ef694ae1ce0509e94bf2f65",
  "notes": "Same-class unprotected post-execute scratch read also at atombios_dp.c:114 (DP aux) \u2014 covered by the same fix umbrella; noted for the maintainer rather than filed separately (out of this files scope). Guest /tmp artifacts removed after the attempt.",
  "recommended_fix": "Port radeons scratch_mutex: add struct lock scratch_mutex to amdgpu atom_context, hold it around the whole amdgpu_atom_execute_table and across the i2c copy_swap window (see fix.diff, 4 files).",
  "fix_status": "not_testable",
  "fix_baseline_reproduced": false,
  "fix_patched_reproduced": false,
  "fix_verdict": "Fix validation not testable: no AMD GPU on the audit guest, so neither baseline nor patched behavior can be exercised. fix.diff mirrors the upstream-accepted radeon fix line-for-line in structure and applies cleanly (git apply --check).",
  "fix_evidence": "fix.diff (atom.h/atom.c/atombios_i2c.c/amdgpu_atombios.c); radeon reference implementation cited in VERDICT.md"
}