DF-4119 — Inverted error check in cypress_dpm_init: ATOM engine-PLL reference divider used only on FAILURE (twin of DF-3976) ===================================================================== File: sys/dev/drm/radeon/cypress_dpm.c:2059-2064 — pass 2 (GLM 5.3).

ret = radeon_atom_get_clock_dividers(rdev, COMPUTE_ENGINE_PLL_PARAM,
                     0, false, &dividers);
if (ret)                                   /* inverted (DF-3976 twin) */
    pi->ref_div = dividers.ref_div + 1;   /* uninit stack on failure */
else
    pi->ref_div = R600_REFERENCEDIVIDER_DFLT;  /* default on SUCCESS */

• Normal hardware (call SUCCEEDS): computed divider discarded, ref_div hardcoded to 4.
• Failing call: dividers (cypress_dpm.c:2029, stack) is consumed uninitialized -> garbage pi->ref_div.
• Sink: rv770_dpm.c:815 MPLL_LOCK_TIME(R600_MPLLLOCKTIME_DFLT * pi->ref_div) and engine-speed parameter programming -> wrong memory PLL lock timings (functional, not memory-unsafe).
• Upstream Linux master carries the same inverted condition in cypress_dpm.c AND btc_dpm.c (verified against torvalds/linux 2026-09-18); btc twin filed as DF-3976. Hardware-gated; no security-relevant memory sink; Low. FIX: fix.diff — if (!ret) (one line).

DF-4119 VERDICT — inverted ref_div error check in cypress_dpm_init

STATUS: inconclusive (runtime hardware-gated); source certain, verified against upstream. impact: none (functional; wrong PLL lock timings / uninitialized-stack-derived value programmed to hardware). confidence: certain.

CHAIN: * cypress_dpm.c:2059-2064 — if (ret) pi->ref_div = dividers.ref_div+1; else pi->ref_div = R600_REFERENCEDIVIDER_DFLT; * struct atom_clock_dividers dividers; at :2029 is UNINITIALIZED stack; radeon_atom_get_clock_dividers does not fully populate it on failure => the failure branch consumes garbage (also an uninitialized-read defect, stack-info flows only into a register value programmed to the GPU, never to userspace). * The success branch (normal hardware) discards the ATOM-computed divider and hardcodes 4. * Sink: pi->ref_div at rv770_dpm.c:815 (MPLL_LOCK_TIME(R600_MPLLLOCKTIME_DFLT * pi->ref_div) inside rv770's memory-PLL timing programming, shared by this dispatch). * Upstream comparison (2026-09-18, torvalds/linux master): cypress_dpm.c and btc_dpm.c BOTH carry if (ret) — upstream-shared defect, exactly like the basis on which DF-3976 (btc twin) was filed. DragonFly import (FreeBSD radeon port) inherits it.

FIX: fix.diff — invert to if (!ret). fix_status not_testable (no hardware to validate programming against).

Fix status (batch validation)

Applied with the 36 sibling fix.diffs of this batch in findings/poc/_batch41/all_fixes.patch; single in-guest make -j6 nativekernel KERNCONF=X86_64_GENERIC completed RC=0 with zero errors under -Werror (full log: findings/poc/_batch41/fix_build8.log). Behavior A/B intentionally skipped for this Info-tier item.