{
  "finding_id": "DF-5236",
  "status": "untested",
  "reproduced": false,
  "impact": "none",
  "confidence": "certain",
  "verdict": "Info (latent, unreachable). hw_translate_diag.c:34-37 installs an all-NULL struct hw_translate_funcs and dal_hw_translate_diag_fpga_init (hw_translate_diag.c:39-42) reports success with no functional translator; the first GPIO operation (gpio_service.c:151 offset_to_id, gpio_service.c:418 offset_to_id, gpio_base.c:144 id_to_offset) would be an immediate NULL function-pointer call => kernel panic. Reachability is proven dead on this tree: the sole entry (hw_translate.c:61-64) is gated on IS_FPGA_MAXIMUS_DC (dc_types.h:58-59) and the only dce_environment assignment anywhere is the hardcoded DCE_ENV_PRODUCTION_DRV at amdgpu_dm.c:424 (copied at core/dc.c:624, consumed at core/dc.c:661-663); no sysctl/ioctl/module parameter can select DCE_ENV_FPGA_MAXIMUS, and enum zero-init is production (dc_types.h:47). Family-consistent with DF-5231 (hw_factory_diag, Info) and the unreachable i2caux diag twin. Panic-only even if activated; the NULLs are compile-time constants, so there is no attacker-steerable pointer and no exploit chain. Phase V skipped per contract for Info hardening findings.",
  "exploit_chain": "",
  "evidence": "findings/poc/DF-5236/VERDICT.md (full reachability proof); hw_translate_diag.c:34-42 (all-NULL table + init); hw_translate.c:61-64 (sole caller, FPGA gate); dc_types.h:46-59 (enum + IS_FPGA_MAXIMUS_DC); amdgpu_dm.c:424 (hardcoded production env); gpio_service.c:151,418 and gpio_base.c:144 (unconditional NULL-call sites); gpio_service.c:69-73 (unknown-ASIC failure handled, NULL table cannot leak); Makefile:252 (compiled but dead).",
  "kernel_refs": [
    "sys/dev/drm/amd/display/dc/gpio/diagnostics/hw_translate_diag.c:34",
    "sys/dev/drm/amd/display/dc/gpio/diagnostics/hw_translate_diag.c:39",
    "sys/dev/drm/amd/display/dc/gpio/hw_translate.c:61",
    "sys/dev/drm/amd/display/dc/dc_types.h:46",
    "sys/dev/drm/amd/display/dc/dc_types.h:58",
    "sys/dev/drm/amd/display/amdgpu_dm/amdgpu_dm.c:424",
    "sys/dev/drm/amd/display/dc/core/dc.c:624",
    "sys/dev/drm/amd/display/dc/core/dc.c:661",
    "sys/dev/drm/amd/display/dc/gpio/gpio_service.c:151",
    "sys/dev/drm/amd/display/dc/gpio/gpio_service.c:418",
    "sys/dev/drm/amd/display/dc/gpio/gpio_base.c:144",
    "sys/dev/drm/amd/display/dc/gpio/gpio_service.c:69",
    "sys/dev/drm/amd/amdgpu/Makefile:252"
  ],
  "poc_changes": "No PoC authored: the trigger requires a source-level change (forcing DCE_ENV_FPGA_MAXIMUS at amdgpu_dm.c:424), i.e. not reachable on a shipped kernel; recorded honestly as untested rather than fabricating a runnable trigger.",
  "attempts": 0,
  "guest_uname": "",
  "runtime_sec": 0,
  "guest_dirty": 0,
  "build_cmd": "",
  "run_cmd": "",
  "code_hash": "",
  "notes": "Pass-2 result for the last gpio/ file; completes the diagnostics-twin family (hw_factory_diag DF-5231, i2caux diag unreachable-proven, hw_translate_diag this). Negative results also proven: enum zero-init is production (DCE_ENV_PRODUCTION_DRV=0), dal_hw_translate_init default-false is handled by dal_gpio_service_create (gpio_service.c:69-73, 137-140), no dangling funcs on destroy (translate is by-value in the service), no other caller tree-wide. fix.diff replaces NULLs with false-returning stubs; deleting the Makefile:252 objects is equally valid.",
  "recommended_fix": "Replace the two NULL entries in hw_translate_diag.cs funcs table with explicit false-returning stubs (see findings/poc/DF-5236/fix.diff), or drop hw_translate_diag.c/hw_factory_diag.c from the amdgpu build (Makefile:252).",
  "fix_status": "not_applicable",
  "fix_baseline_reproduced": 0,
  "fix_patched_reproduced": 0,
  "fix_verdict": "Fix not built/tested: the finding is Info and unreachable on shipped kernels (hardcoded DCE_ENV_PRODUCTION_DRV at amdgpu_dm.c:424), so there is no observable baseline behavior to A/B on the guest. fix.diff is a defensive compile-level change (NULL entries -> false-returning stubs) authored against the read-only sys/ tree and never applied there.",
  "fix_evidence": "findings/poc/DF-5236/fix.diff"
}