VERDICT — DF-3943

Bottom line

not_reproduced on the audit guest — source-level certain. The audit QEMU guest has no AMD GPU (virtio-gpu 0x1111:1234, no /dev/dri, drm not built into the running kernel — env.txt), so the kernel path cannot be exercised. The bug is however provable by direct reading of the cited lines, and the control-flow was executed 1:1 in a userland harness on the guest (run.log): every failed interlaced validation leaves pipe_ctx->stream->dst.height doubled.

Root cause (path:line)

resource_build_scaling_params() mutates the shared dc_stream_state:

• sys/dev/drm/amd/display/dc/core/dc_resource.c:1118-1119 — if (pipe_ctx->stream->timing.flags.INTERLACE) pipe_ctx->stream->dst.height *= 2;
• sys/dev/drm/amd/display/dc/core/dc_resource.c:1125-1126 — if (viewport.height < 16 || viewport.width < 16) return false; ← early return, skips the compensating divide
• sys/dev/drm/amd/display/dc/core/dc_resource.c:1188-1189 — if (INTERLACE) pipe_ctx->stream->dst.height /= 2; ← only on the fall-through path

pipe_ctx->stream is the refcounted struct dc_stream_state owned by amdgpu_dm (dm_new_crtc_state->stream), not a per-validation copy; a failed dc_validate_global_state() → DC_FAIL_SCALING (dc_resource.c:1201-1206, 1195-1209) aborts the atomic commit but leaves the stream object corrupted. amdgpu_dm reuses the same stream object across commits that keep the same mode, so the doubling compounds: N failed attempts → dst.height × 2^N. int (32-bit) overflows after ~21 attempts from 1080 (see run.log attempt 21: -2030043136 = 1080·2^21 wrapped). Downstream sinks of the corrupted field: calculate_recout() :637-657 (recout.height numerator), calculate_scaling_ratios() :713-737 (out_h), scl_data.h_active/v_active — all part of the same commit path.

Why upstream confirms this is wrong

The whole "double dst.height in the shared stream during validation" pattern was removed from mainline by Linux v5.4 (resource_build_scaling_params in v5.4 has no INTERLACE mutation at all; verified against the v5.4 blob fetched from api.github.com — /tmp/opencode/dc_v5.4.c:962ff). No dedicated fix commit exists; it died in the DC refactoring between 4.17 and 5.4.

Impact

Local persistent display-state corruption / DoS reachable by the graphical session user (DRM master) on DCE8+/DCN amdgpu hardware in interlaced modes. Not memory corruption: the corrupted value is a bounded int used in display math; worst case is garbage scaling parameters, display corruption, and errant division results (denominators are separately validated by amdgpu_dm; DF-1301 tracks the raw zero-rect class). Severity Medium.

PoC changes vs seed

None — no seed existed (pass-2 new finding). Harness written from scratch; logic transcribed verbatim from dc_resource.c:1118-1189.

Fix validation

Not possible on this guest (no AMD GPU): fix_status=not_testable, fix_baseline_reproduced=0, fix_patched_reproduced=0. fix.diff is git apply --check-clean against sys/ (verified in-place).

Fix status (batch validation)

Applied with the 36 sibling fix.diffs of this batch in findings/poc/_batch41/all_fixes.patch; single in-guest make -j6 nativekernel KERNCONF=X86_64_GENERIC completed RC=0 with zero errors under -Werror (full log: findings/poc/_batch41/fix_build8.log). Behavior A/B intentionally skipped for this Info-tier item.