DF-3947 — dce110_apply_ctx_to_hw(): error return leaves VBIOS scratch "critical state" latched

Severity: Info (error-path hygiene; requires faulty BIOS/HW to reach) CWE-459 / missing cleanup on error path

Bug

sys/dev/drm/amd/display/dc/dce110/dce110_hw_sequencer.c:2010-2090:

    dcb->funcs->set_scratch_critical_state(dcb, true);   /* :2028 */
    ...
        status = apply_single_controller_ctx_to_hw(...);  /* :2073 */
        if (DC_OK != status) {
            return status;                           /* :2080 — early out */
        }
    }
    dcb->funcs->set_scratch_critical_state(dcb, false);  /* :2084 — skipped */

apply_single_controller_ctx_to_hw() fails (returns DC_ERROR_UNEXPECTED) whenever program_pix_clk fails (dce110_hw_sequencer.c:1324-1330) or bios_parser_crtc_source_select fails (:1399-1403) — i.e. faulty VBIOS tables or failing clock programming. The early return at :2080 leaves the VBIOS scratch "critical state" bit set; the driver never clears it on this path. The stuck bit tells VBIOS/SMU that display config is mid-transition, which can misdirect firmware-side power-management/event handling until the next successful commit. Also skips enable_fbc (:2086-2087) — cosmetic.

No memory-safety impact; the fix is the standard goto-out cleanup.

Fix

        if (DC_OK != status) {
+           dcb->funcs->set_scratch_critical_state(dcb, false);
            return status;
        }

Not PoC-verified (needs DCE-class AMD hardware and an induced BIOS failure); source-certain. No evidence pack beyond this README/manifest/verdict.

DF-3947 — Verification Verdict

Status: untested (Info-severity error-path finding; verification skipped per policy — hardware+BIOS-failure gated, no security impact beyond hygiene) Impact: none demonstrated Confidence: certain (source)

Source: set at dce110_hw_sequencer.c:2028, cleared only at :2084; the error return at :2079-2081 (if (DC_OK != status) return status;) bypasses it. Failure sources: dce110_hw_sequencer.c:1324-1330 (program_pix_clk false) and :1399-1403 (crtc_source_select != BP_RESULT_OK).

No runtime test performed (no AMD GPU on the audit guest). fix.diff is the one-line cleanup; kernel rebuild not warranted for an Info finding.

Fix status (batch validation)

Applied with the 36 sibling fix.diffs of this batch in findings/poc/_batch41/all_fixes.patch; single in-guest make -j6 nativekernel KERNCONF=X86_64_GENERIC completed RC=0 with zero errors under -Werror (full log: findings/poc/_batch41/fix_build8.log). Behavior A/B intentionally skipped for this Info-tier item.