β¬’ DragonFlyBSD Kernel Audit
← triage Β· dashboard
DF-5097

helper2 hub wires v1 dce80/dce110 tables into the atomfirmware parser; both tables lack transmitter_color_depth_to_atom and dc_clock_type_to_atom which command_table2.c invokes unguarded β€” latent NULL function-pointer kernel panic under cross-generation VBIOS pairing (parser2 twin of DF-5000/DF-4985)

Summary

The hub hands legacy-parser vtables (missing the two members parser2 calls unguarded in set_pixel_clock_v7 and set_dce_clock_v2_1) to the atomfirmware parser. Unreachable on genuine silicon (parser2 requires >=2.2 ROM + >=1.4 displayobjectinfo, which DCE8/10/11 VBIOSes never carry) - requires a cross-generation VBIOS transplant, same lock class as DF-4985/DF-5000. Drop-the-v1-cases fix.

Discussion (0)

No comments yet.

PoC verification

Evidence pack

findings/poc/DF-5097 Β· 1 files
FileTypeDescriptionSize
verdict.json file 927 B view raw

Fix verification

not_testable
baseline no→ patch + rebuild →patched clean
per-fix-DF-5097

Confirmed kernel references

Detail

Evidence (decisive lines)

source trace in finding markdown

Verified recommended fix

see finding markdown

Verdict

untested (hardware-gated: no AMD ASIC on guest; latent-by-analysis)