DF-5096
parser2 command-table helper hub failure ignored leaves bp->cmd_helper NULL inside a 'successfully' constructed firmware BIOS parser β latent whole-vtable NULL function-pointer call (v2 twin of DF-5075)
Summary
The hub correctly returns false for unmapped versions but bios_parser2.c:1987 ignores it and construct returns true - a live dc_bios with a NULL cmd_helper whose ~17 member calls in command_table2.c are all unguarded. On this build both DCN macros are force-defined so the only failing input (DCE_VERSION_UNKNOWN) triple-fails-closed at i2caux/gpio/res_pool before any BIOS command - strictly more locked than DF-5075, hence Info. Propagate-the-failure fix.
Discussion (0)
PoC verification
Evidence pack
findings/poc/DF-5096 Β· 1 files| File | Type | Description | Size | |
|---|---|---|---|---|
| verdict.json | file | 927 B | view raw |
Fix verification
not_testablebaseline noβ patch + rebuild βpatched clean
per-fix-DF-5096
Confirmed kernel references
Detail
Evidence (decisive lines)
source trace in finding markdown
Verified recommended fix
see finding markdown
Verdict
untested (hardware-gated: no AMD ASIC on guest; latent-by-analysis)
No comments yet.