DF-4449 — dce120 audio_regs[] has 6 entries but res_cap.num_audio = 7 (latent OOB; upstream fix 44035ec2fde1 missing)

File: sys/dev/drm/amd/display/dc/dce120/dce120_resource.c Severity: Info (latent hardening / upstream-divergence tracking) · CWE: CWE-129

Facts

• audio_regs[] defines entries 0..5 only (dce120_resource.c:322-329).
• res_cap.num_audio = 7 (:438-444).
• create_audio(ctx, inst) passes &audio_regs[inst] straight into dce_audio_create (:605-610), which stores the pointer as the endpoint's register table.

Upstream history (the reason this matters)

Upstream Linux hit exactly this mismatch and fixed it in commit 44035ec2fde1 "drm/amd/dc/dce120: Fix audio register mapping, stop triggering KASAN" (Lyude Paul, 2022-11-23, Cc: stable):

BUG: KASAN: global-out-of-bounds in read_indirect_azalia_reg "on my dce120 GPU there are supposedly 7 sets of audio registers. But we only define a register mapping for 6 sets."

The upstream fix adds audio_regs(6) (verified present in v6.6; absent in v4.19..v5.10 — the bug became reachable upstream when resource.c dropped the pipe_count cap on the audio-creation loop).

Why DF is latent (not reachable today)

The DF resource_construct caps the audio-creation loop at pipe count:

• sys/dev/drm/amd/display/dc/core/dc_resource.c:232: for (i = 0; i < pool->pipe_count && i < num_audio; i++)

pipe_count is 6 (or fewer with Vega20 harvesting), so create_audio is only ever called with inst 0..5 — audio_regs[6] is never formed in this tree. No runtime OOB today. The mismatch becomes a live global-out-of-bounds (KASAN-proven class) the moment dc_resource.c is synced to the modern upstream loop (i < num_audio uncapped), which is precisely how upstream got bitten.

Recommended fix

Apply the upstream fix verbatim (one line, also removes the mismatch even while latent):

    audio_regs(4),
-   audio_regs(5)
+   audio_regs(5),
+   audio_regs(6)
 };

Fix status (batch validation)

Applied with the 36 sibling fix.diffs of this batch in findings/poc/_batch41/all_fixes.patch; single in-guest make -j6 nativekernel KERNCONF=X86_64_GENERIC completed RC=0 with zero errors under -Werror (full log: findings/poc/_batch41/fix_build8.log). Behavior A/B intentionally skipped for this Info-tier item.