Unsynchronized check-then-set of i2c_hw_buffer_in_use plus clear-before-release lets concurrent I2C acquisitions jointly drive the single shared DCE80 DC_I2C engine — interleaved single-instance MMIO and per-engine tracking divergence from the shared 144-byte HW data FIFO (dce80 twin of DF-5035/DF-4878; the DAL2 mutex was dropped in the port)

Summary

The flag is set only AFTER engine->acquire completes (a us-scale window) and cleared BEFORE the shared HW release - two DDC lines can both hold the single DC_I2C engine, corrupting DDC/EDID data and wedging the engine. Kernel memory stays in-bounds (transaction index capped, byte-at-a-time MMIO) - data-integrity + functional DoS. Hardware-gated (DCE80/CIK absent from guest). Atomic test-and-set + clear-after-release fix.