DF-4446 evidence pack

• What: On DragonFly the Linux-compat i2c shim replaces the bit-bang algorithm with a stub: i2c_bit_add_bus() (sys/dev/drm/linux_i2c.c:127-134) installs i2c_bit_algo whose master_xfer is bit_xfer() — "XXX Linux really does try to transfer some data here" — return 0; (linux_i2c.c:106-111), never calling algo_data callbacks. In radeon_i2c_create()'s bit-bus branch (sys/dev/drm/radeon/radeon_i2c.c:955-978) this makes pre_xfer/post_xfer/get_clock/get_data/set_clock/set_data (radeon_i2c.c:90-232) dead code, and every DDC/EDID transaction on a bit-banged bus "succeeds" with 0 messages transferred — so with the default radeon_hw_i2c=0 (all non-mm_i2c DDC buses take the bit branch), radeon_ddc_probe() always fails (ret != 2, radeon_i2c.c:72-74) and drm_do_probe_ddc_edid() never obtains an EDID: display detection is silently dead for pre-DCE3 radeons (and any bit-path bus) on DragonFly.
• Severity: Info (functional availability defect of the port; no memory safety — no attacker primitive). Verification skipped per contract (Info), and the audit guest has no radeon hardware anyway.
• Fix direction: implement the bit-bang protocol in sys/dev/drm/linux_i2c.c using i2c_algo_bit_data callbacks (port Linux's i2c-algo-bit.c bit_xfer), or route the DF radeon bit buses through the real hardware GPIO engine.

Files

• VERDICT.md — static line-cited analysis
• verdict.json (status untested), manifest.json

DF-4446 — DF i2c bit-bang shim is a stub: all radeon bit-bang DDC/EDID transfers are silent no-ops; the entire bit-bang block of radeon_i2c.c is dead code on DragonFly

Verdict

Status: untested (Info severity — skipped per contract; also hardware-gated). Static analysis: certain.

Line-cited trace

1. radeon_i2c_create() bit-bus branch (sys/dev/drm/radeon/radeon_i2c.c:955-978): sets i2c->adapter.algo_data = &i2c->bit; and the six callbacks (pre_xfer/post_xfer/set_clock/set_data/get_clock/get_data), then calls i2c_bit_add_bus(&i2c->adapter).
2. DF's shim i2c_bit_add_bus() (sys/dev/drm/linux_i2c.c:127-134) does adapter->algo = &i2c_bit_algo; adapter->retries = 2; return 0; — overwriting nothing that matters, because i2c_bit_algo.master_xfer is bit_xfer() (linux_i2c.c:106-111): /* XXX Linux really does try to transfer some data here */ return 0; — it never looks at algo_data, so none of radeon's GPIO bit-bang callbacks (radeon_i2c.c:90-232) ever execute.
3. With the module default radeon_hw_i2c == 0, the selection logic at radeon_i2c.c:933-955 routes every non-mm_i2c bus (i.e. every DDC bus) to this bit branch; only radeon_hw_i2c=1 (explicitly discouraged by radeon_i2c_init()'s own warning at :999-1000) selects the real r100/r500/atom hardware engines.
4. Effect: i2c_transfer() (linux_i2c.c:91-104) calls bit_xfer → 0; callers require ret == num: radeon_ddc_probe() (radeon_i2c.c:66-74) always returns false; drm_do_probe_ddc_edid() (sys/dev/drm/drm_edid.c:1513-1558) always fails → no EDID on any bit-path bus → connector reports disconnected. (Contrast i915: intel_i2c.c keeps the real GMBUS algorithm and only uses the stub as a rare fallback, so i915 DDC works.)

Also noted (no independent finding): the DF-only i2c_add_adapter(&i2c->adapter) call placed between i2c_bit_add_bus() and its error check (radeon_i2c.c:970-973) is a latent UAF pattern (adapter registered then chan freed on bit_add_bus failure), but on the current shim both functions unconditionally return 0, so the path is unreachable — recorded here for when the shim grows real error returns.

Impact

Functional: display hotplug/EDID detection dead for bit-banged buses (pre-DCE3 radeon, and any bus on the bit path) on DragonFly. No memory safety, no attacker primitive → Info.

Fix direction

Port Linux's drivers/i2c/algos/i2c-algo-bit.c bit_xfer() into sys/dev/drm/linux_i2c.c (it only needs the i2c_algo_bit_data callbacks already declared in sys/dev/drm/include/linux/i2c-algo-bit.h), or bypass the shim for radeon buses. i915 is unaffected either way.

Fix status (batch validation)

Applied with the 36 sibling fix.diffs of this batch in findings/poc/_batch41/all_fixes.patch; single in-guest make -j6 nativekernel KERNCONF=X86_64_GENERIC completed RC=0 with zero errors under -Werror (full log: findings/poc/_batch41/fix_build8.log). Behavior A/B intentionally skipped for this Info-tier item.

(No fix.diff for this item: documented recommendation only - see Fix above.)