Summary

acquire_i2c_hw_engine guards the per-line engine lookup only with if (line < GPIO_DDC_LINE_COUNT) (i2caux_dce80.c:124). enum gpio_ddc_line is a signed type (it defines GPIO_DDC_LINE_UNKNOWN = -1 at gpio_types.h:207), so a returned UNKNOWN value satisfies -1 < 8 and the subsequent i2caux->i2c_hw_engines[line] (line 126) becomes a negative-index OOB read. No demonstrable impact in the current dce80 configuration because the aliased adjacent slot resolves to NULL and is caught at line 130, but the bound is incorrect and fragile.

Root cause

• i2caux_dce80.c:122 enum gpio_ddc_line line = dal_ddc_get_line(ddc); — dal_ddc_get_line (gpio_service.c:566-570) returns (enum gpio_ddc_line)dal_gpio_get_enum(ddc->pin_data) and gpio->en is a raw uint32_t (gpio_base.c:122-126, set from an unvalidated en parameter at gpio_base.c:252 and hw_gpio.c:187), so it is not guaranteed to be a valid in-range enum value.
• i2caux_dce80.c:124 if (line < GPIO_DDC_LINE_COUNT) performs a SIGNED comparison (the enum type holds -1) and omits the lower bound line >= 0 / line != GPIO_DDC_LINE_UNKNOWN.
• i2caux_dce80.c:126 engine = i2caux->i2c_hw_engines[line]; indexes with the unchecked (possibly -1) value.

The identical missing-lower-bound pattern is present in all siblings (dce110 i2caux_dce110.c:98) and in the shared helper get_hw_supported_ddc_line (i2caux.c:287), so this is systemic.

Threat model & preconditions

• Attacker position: privileged local user (root) with the ability to load a crafted VBIOS connector table, or a developer triggering the path before GPIO assignment.
• Privileges gained or impact: none demonstrated.
• Required config or capabilities: a struct ddc whose hw_info.hw_supported is true yet whose pin_data->en maps to GPIO_DDC_LINE_UNKNOWN or another out-of-range value when cast through the enum.
• Reachability: plausible from a malformed/misprogrammed VBIOS connector table or a DDC handle used before its GPIO line is assigned.

Proof of concept

No working exploit — impact is not demonstrated. Under the current dce80 struct layout (i2caux.h:67-75: i2c_sw_engines[8] immediately precedes i2c_hw_engines[8]), the read at index -1 aliases i2c_sw_engines[7], which dce80's construct never writes, so engine resolves to NULL and the function returns NULL at line 130 — benign. Reproducing a crash would additionally require i2c_sw_engines[7] to hold a non-NULL stale/garbage pointer, which dce80 does not produce. Filed as Info/hardening.

Impact

Defense-in-depth gap, no demonstrated privilege or availability impact today. A future struct reordering, or a sibling that initializes i2c_sw_engines[7], would turn this into a real OOB read.

Recommended fix

Add the missing lower bound so the signed UNKNOWN sentinel and any negative value are rejected before indexing. GPIO_DDC_LINE_MIN is already defined as GPIO_DDC_LINE_DDC1 (=0) at gpio_types.h:218.

--- a/sys/dev/drm/amd/display/dc/i2caux/dce80/i2caux_dce80.c
+++ b/sys/dev/drm/amd/display/dc/i2caux/dce80/i2caux_dce80.c
@@ -121,7 +121,8 @@ static struct i2c_engine *acquire_i2c_hw_engine(
    if (ddc->hw_info.hw_supported) {
        enum gpio_ddc_line line = dal_ddc_get_line(ddc);

-       if (line < GPIO_DDC_LINE_COUNT) {
+       if (line >= GPIO_DDC_LINE_MIN &&
+           line < GPIO_DDC_LINE_COUNT) {
            non_generic = true;
            engine = i2caux->i2c_hw_engines[line];
        }

The same one-line lower-bound guard should be applied to the siblings (dce100/110/112/120 acquire_i2c_hw_engine) and to get_hw_supported_ddc_line() in i2caux.c:287 for a complete fix; those are outside this file.

References

• sys/dev/drm/amd/display/dc/i2caux/i2caux.c:287 — same missing bound in the shared helper.
• sys/dev/drm/amd/display/dc/i2caux/dce110/i2caux_dce110.c:98 — same missing bound in the dce110 sibling.

Timeline

• 2026-07-25 Discovered during automated audit.
• 2026-07-25 Reported to DragonFlyBSD security contact.