DF-4034 evidence pack

radeon_connector_get_edid dereferences radeon_connector->ddc_bus->has_aux (radeon_connectors.c:311, and :320 in the DP/eDP branch) without checking ddc_bus. radeon_add_atom_connector continues with dd

Build

./build.sh   (cc -O2 -Wall; verified on the DragonFly audit guest — build.log)

Run

./run.sh     (verified on the DragonFly audit guest — run.log; triggers exit 2:
             /dev/dri absent — no radeon GPU on the QEMU guest, see env.txt)

Expected on r600/rv770 hardware

See VERDICT.md.

DF-4034 — radeon_connector_get_edid() dereferences ddc_bus->has_aux with ddc_bus == NULL

File: sys/dev/drm/radeon/radeon_connectors.c Severity: Low (unprivileged local DoS panic; hardware/BIOS-gated) Class: CWE-476 NULL pointer dereference.

Root cause (path:line)

309:    if ((radeon_connector_encoder_get_dp_bridge_encoder_id(connector) !=
310:         ENCODER_OBJECT_ID_NONE) &&
311:        radeon_connector->ddc_bus->has_aux) {

The DP-bridge test (possible encoders contain TRAVIS/NUTMEG — static BIOS data) is evaluated first; ddc_bus->has_aux is then dereferenced unconditionally. A DP-bridge connector whose i2c bus lookup failed is still created with ddc_bus == NULL (radeon_add_atom_connector, radeon_connectors.c:1961-1966: lookup failure only prints "DP: Failed to assign ddc bus!" and continues). Every later radeon_connector_get_edid() — i.e. every detect/get_modes — then panics at :311.

A second, narrower variant sits in the DP/eDP branch at :318-320 (radeon_connector->ddc_bus->has_aux evaluated after dig->dp_sink_type is set to DISPLAYPORT by radeon_dp_detect, radeon_connectors.c:1709/1721) — the else if at :323 shows the author did remember the NULL check for the non-aux path, proving the :311/:320 dereferences are oversights.

Reachability: unprivileged — DRM_IOCTL_MODE_GETCONNECTOR has no master/auth gate (sys/dev/drm/drm_ioctl.c:663, DRM_UNLOCKED only) and drives fill_modes → radeon_*_get_modes → radeon_connector_get_edid. Preconditions: radeon KMS + a DP-bridge (Travis/Nutmeg) connector + failed i2c-bus assignment (error is visible in dmesg at boot: "Failed to assign ddc bus!").

Upstream status

Identical dereference in current Linux master (upstream radeon_connectors.c:271-273). Unfixed upstream.

Verification (this pack)

• conn_probe.c mode getconnector — raw unauthenticated GETCONNECTOR loop over all connectors (builds clean on the guest; run.log).
• Runtime hardware-gated (no radeon GPU on the audit guest — env.txt); the dereference is source-certain given the boot-time misconfiguration.

Suggested fix

fix.diff: add radeon_connector->ddc_bus && before both has_aux tests.

Fix status (batch validation)

Applied with the 36 sibling fix.diffs of this batch in findings/poc/_batch41/all_fixes.patch; single in-guest make -j6 nativekernel KERNCONF=X86_64_GENERIC completed RC=0 with zero errors under -Werror (full log: findings/poc/_batch41/fix_build8.log). Behavior A/B intentionally skipped for this Info-tier item.