DF-5078 — DCE120 irq table VLINE0 gap → NULL .funcs dispatch

File: sys/dev/drm/amd/display/dc/irq/dce120/irq_service_dce120.c:177-263 (DF-2168/DF-4713/DF-4932/DF-4995/DF-5054 family instance on the DCE120 table — the shape noted for maintainers in DF-4932's verdict)

Build (on the guest)

mkdir -p /root/df5078 && cp dce120_vline0gap.c build.sh run.sh /root/df5078/
sh /root/df5078/build.sh

Run (on the guest; run twice for determinism)

sh /root/df5078/run.sh     # -> run.log, run.2.log

Expected

• baseline (dce120_vline0gap_base):
• static audit: exactly 6 NULL-funcs slots — 84..89 (DC_IRQ_SOURCE_DC{1..6}_VLINE0, enum 84..89 < DAL_IRQ_SOURCES_NUMBER=90, irq_types.h:140-148);
• controls pass: ack(90) rejected; set(PFLIP1) generic; dce120 hpd_ack polarity toggle; VBLANK1..6 through the real conversion path arm pipes 0..5; to_dal sweep (256 src x 13 ext) returns 0 results in 84..89;
• trigger: dal_irq_service_ack(DC_IRQ_SOURCE_DC1_VLINE0) → child dies signal 11 at the info->funcs->ack deref (irq_service.c:152); dal_irq_service_set(...) in the main process → SIGSEGV exit 139 (:116 acks first → same deref). Kernel-equivalent: page-0 read ⇒ panic.
• fixed (-DFIX_DF5078, = fix.diff): 0 NULL-funcs slots, dummy handlers log-and-return, exit 0.

Observed (guest, cc 8.3): baseline exit=139 x2 (child signal 11 + main fault), fixed exit=0 x2. Kernel console corroborates the faults (dmesg.txt: pid ... (dce120_vline0gap) ... exited on signal 11).

Fix validation: both dce120 fix.diffs (DF-5078 + DF-5079) applied to guest /usr/src, full make -j6 amdgpu.ko module rebuild rc=0, 0 errors / 0 warnings under -Werror (amdgpu_module_build.log, 777 lines; irq_service_dce110.c + irq_service_dce120.c both recompiled at :571-574); sources reverted md5-verified pristine; make clean.

Reachability is latent (traced in VERDICT.md) and the guest has no AMD GPU — family-standard logic-level replica methodology (same as DF-4932/DF-4995/DF-5054).

DF-5078 VERDICT — dce120 VLINE0 table gap (NULL .funcs dispatch), replica-reproduced

Status: reproduced (logic level, family-standard replica), impact panic, confidence certain. Same methodology and ceiling as DF-4932 (dce110), DF-4995 (dcn10), DF-5054 (dce80) — the DCE120 instance of the family, noted for maintainers in DF-4932's verdict and now filed per-file ("each asic table is its own code").

Root cause (code-certain)

irq_source_info_dce120[DAL_IRQ_SOURCES_NUMBER] (irq_service_dce120.c:177-263) designators cover exactly enum sources 0..83:

INVALID(0); HPD1+0..5(1..6); HPD1RX+0..5(7..12); I2C_DDC1..6(13..18);
DPSINK1..6(19..24); TIMER(25); PFLIP1+0..5(26..31); PFLIP_UNDERLAY0(32);
GPIOPAD0..30(33..63); DC1..6UNDERFLOW(64..69); DMCU_SCP(70); VBIOS_SW(71);
VUPDATE1+0..5(72..77); VBLANK1+0..5(78..83)

The shared enum (irq_types.h:40-148) continues to DC_IRQ_SOURCE_DC{1..6}_LINE0 = 84..89 < DAL_IRQ_SOURCES_NUMBER=90 — those six entries stay zero-initialized, .funcs == NULL. find_irq_source_info (irq_service.c:77-86) bounds-checks ONLY the index, so dal_irq_service_ack (:152 — invoked FIRST by dal_irq_service_set at :116) dereferences info->funcs->ack on NULL, and dal_irq_service_set (:118) info->funcs->set — a read at page-0 offset ~40 ⇒ kernel page fault/panic. DF-2168/DF-4713 is the hub-level family root; this is the dce120 table's own completeness gap.

Reproduction (this run, on the audit guest)

Verbatim userland replica of the dce120 entry macros + FULL table body + dce120 hpd_ack + dummy funcs + dce110_vblank_set + to_dal_irq_source_dce110 + the irq_service.c:77-158 dispatch (see dce120_vline0gap.c header for the path:line map). Results (run.log, run.2.log — deterministic x2):

• static audit: NULL-funcs entries: 84 85 86 87 88 89 (6 NULL-funcs slots)
• controls: ack(90) rejected; set(PFLIP1) generic path ok; dce120 hpd_ack polarity toggle ok; VBLANK1..6 arm pipes 0..5 through the real conversion; to_dal sweep (256 src x 13 ext incl. 0xdead): 0 returns in 84..89
• trigger-child ack(84): info->funcs == 0x0 → signal 11
• trigger-main set(84): Segmentation fault, exit 139
• fixed mode (six dummy entries = fix.diff): 0 NULL-funcs, dummy handlers log-and-return, exit 0

Kernel console corroborates the faults on the guest (dmesg.txt: four pid ... (dce120_vline0gap) ... exited on signal 11 lines per run).

Reachability (traced honestly — latent)

• IH arrival: amdgpu_dm_irq_handler (amdgpu_dm_irq.c:477-487) converts via to_dal_irq_source_dce110 — can only return covered sources or INVALID (dummy entry), never 84..89 (sweep above).
• dm_irq_state (amdgpu_dm_irq.c:535-556): IRQ_TYPE_PFLIP/IRQ_TYPE_VBLANK + acrtc->otg_inst (hardware-bounded 0..5) → 26..31 / 78..83.
• HPD init/fini (amdgpu_dm_irq.c:625-645, 515-527): HPD/HPDRX only.
• amdgpu_dm.c:3014: IRQ_TYPE_VBLANK + acrtc->otg_inst.
• The service exists only on DCE12 (Vega10/12) hardware (dce120_resource.c:1011); guest has 0 AMD PCI devices.

⇒ No unprivileged trigger exists today; the panic is one future caller away (a DM change using VLINE0 on DCE12, or any caller gating on the DAL_VALID_IRQ_SRC_NUM off-by-one at irq_types.h:157-158, which admits src == DAL_IRQ_SOURCES_NUMBER).

Ceiling

NULL-page read at a fixed small offset ⇒ hard kernel panic (local DoS). No write primitive, no leak. Severity Low (family-consistent).

Fix validation

fix.diff = six [DC_IRQ_SOURCE_DCx_VLINE0] = dummy_irq_entry() designators completing the table over the shared enum (DF-4932/DF-4995/DF-5054's exact per-asic shape). Applied to guest /usr/src together with DF-5079's diff: patch -V none -p1, hunk #1 succeeded at :260; full make -j6 amdgpu.ko rebuild rc=0, 0 error: / 0 warning: under -Werror (amdgpu_module_build.log 777 lines; irq_service_dce120.c compiled at :574); replica fixed mode exit 0; sources reverted md5-verified pristine (51bd6ea8...), make clean. Guest returned to clean snapshot afterwards.

Artifacts

dce120_vline0gap.c (code_hash d196028e...), build.log, run.log, run.2.log, dmesg.txt, env.txt, fix.diff, amdgpu_module_build.log, fix_build.log, fix_run.log, manifest.json, verdict.json.

Fix status (batch validation)

Applied with the 36 sibling fix.diffs of this batch in findings/poc/_batch41/all_fixes.patch; single in-guest make -j6 nativekernel KERNCONF=X86_64_GENERIC completed RC=0 with zero errors under -Werror (full log: findings/poc/_batch41/fix_build8.log). Behavior A/B intentionally skipped for this Info-tier item.