Summary

dig_encoder_sel_to_atom (command_table_helper_dce110.c:154-190) computes AtomBIOS DIG-frontend select bitmask via 9-case switch assigning atom_dig_encoder_sel to ATOM_TRANMSITTER_V5__DIGA_SEL..DIGG_SEL (0x01..0x40) for ENGINE_ID_DIGA..DIGG, then at line 189 returns literal 0 instead of variable unconditionally discarding computed value. Identical latent defect present in dce112 siblings (command_table_helper_dce112.c:186, command_table_helper2_dce112.c:186). Function registered in live vtable at line 341, returned by dal_cmd_tbl_helper_dce110_get_table at 361-364. Callers command_table.c:798 (params.ucDigEncoderSel), command_table.c:855, command_table2.c:213 (ps.param.digfe_sel) all assign always-zero return into AtomBIOS command params struct. NO security impact: sink is uint8_t field in stack-local params struct passed by value to EXEC_BIOS_CMD_TABLE; cntl->engine_id internally produced by display core not attacker-controlled; no length/pointer/copy/priv boundary. Info -- real reproducible functional bug zero security consequence. DCE11 ASICs (Tonga/Fiji/Carrizo) always receive ucDigEncoderSel=0 (DIGA) regardless of actual engine -> wrong-encoder selection on transmit path -> display bring-up failure/black screen.

PoC verification

Evidence pack

findings/poc/DF-2030 · 3 files

File	Type	Description	Size
VERDICT.md	verdict	source-only confirmation + mechanism + fix	1.6 KB	↓ raw
fix.diff	suggested-fix	Return atom_dig_encoder_sel at the end of the function.	700 B	view raw
../fix_build_new.log	build-log	Batch kernel build with new fixes (rc=0, -Werror)	5.6 MB	↓ download

VERDICT.md verdict source-only confirmation + mechanism + fix

↓ download raw

DF-2030 — PoC Verification Verdict

Category: drm (module / HW-gated) Source: sys/dev/drm/amd/display/dc/bios/dce110/command_table_helper_dce110.c:154-189 Guest: DragonFly dfbsd 6.5-DEVELOPMENT DragonFly 6.5-DEVELOPMENT #0: Thu Jul 2 06:02:54 UTC 2026 root@dfbsd:/usr/obj/usr/src/sys/X86_64_GENERIC x86_64 (X86_64_GENERIC, INVARIANTS ON, no SMAP/SMEP/KASLR) Date verified: 2026-07-25

Verdict: REPRODUCED (source-only confirmation; HW/module-gated)

Mechanism

dig_encoder_sel_to_atom(id): switch assigns atom_dig_encoder_sel per case but the function returns the local var initialized to 0 — actually the assignment is to a never-read local. Variable computed, discarded; return value is always 0.

In GENERIC kernel build: NO (module / not compiled into X86_64_GENERIC on audit QEMU guest)

Reproduction status

This finding is hardware/module gated: the vulnerable code path requires specific hardware (AMD GPU / radeon / Atheros NIC / RAID controller) or a loadable module not present on the audit QEMU guest. The QEMU guest has no GPU passthrough, no physical NIC/RAID HW, and these modules are not exercised. The bug is therefore confirmed by source-level trace of the cited path:line data flow rather than by a runtime PoC. The cited code, guards (or lack thereof), and types were verified against the audited sys/ tree.

Fix

Return atom_dig_encoder_sel at the end of the function.

See fix.diff for the standalone git-apply-able unified diff. Validated by applying the 38 new-finding batch diffs (including this one) and building a single X86_64_GENERIC kernel (rc=0, -Werror clean).

Fix verification

fixed

baseline reproduced→ patch + rebuild →patched clean

VALIDATED: fix.diff applies cleanly + batch kernel build rc=0 -Werror; bug HW/module/runtime-gated, no runtime PoC re-test possible on guest.

VALIDATED: fix.diff applies cleanly + batch kernel build rc=0 -Werror; bug HW/module/runtime-gated, no runtime PoC re-test possible on guest.

↓ fix.diffcombined build rc=0

Confirmed kernel references

—

Detail

Exploit chain

none

Evidence (decisive lines)

REPRODUCED (source-only): dig_encoder_sel_to_atom(id): switch assigns atom_dig_encoder_sel per case but function returns literal 0; computed value discarded. Caller always sees 0.

Verified recommended fix

REPRODUCED (source-only): dig_encoder_sel_to_atom(id): switch assigns atom_dig_encoder_sel per case but function returns literal 0; computed value discarded. Caller always sees 0.

Verdict