DF-5207 — virtual_lnk_enc_funcs omits 6 of 18 ops (NULL) — latent NULL fp-call

File: sys/dev/drm/amd/display/dc/virtual/virtual_link_encoder.c:86-101 Sibling of DF-5199 (virtual_stream_encoder.c, 7 NULL stream-encoder ops).

Structural proof

struct link_encoder_funcs (inc/hw/link_encoder.h:116-156) declares 18 ops. virtual_lnk_enc_funcs initializes 12. NULL:

Deadness proof (why "latent")

The only instantiation of a virtual link encoder is the num_virtual_links loop in create_links() (dc.c:133-172; kzalloc + virtual_link_encoder_construct at dc.c:161/169). struct dc_init_data init_data is memset to 0 in amdgpu_dm_init() (amdgpu_dm.c:395) and no code anywhere in the tree ever assigns num_virtual_links — verified tree-wide. So the loop body is dead code on every real system; the file is compiled (amdgpu/Makefile:297) but the encoder is never constructed at runtime. The audit guest additionally has no AMD GPU.

Consequence if the family is ever wired up (num_virtual_links > 0) and one of the four unguarded sites ever runs with a virtual encoder: NULL function-pointer call → kernel panic (local DoS; a controllable dispatch primitive in the worst case). Same class/severity as the accepted DF-5199 (Info, CWE-476).

Construct/destroy pairing (checked, correct)

virtual_link_encoder_construct() does not allocate; it only fills an already-kzalloc'd struct link_encoder (dc.c:161) — all fields it touches are assigned, the kzalloc zeroes the rest, so no uninitialized-field read. virtual_link_encoder_destroy() (virtual_link_encoder.c:79-83) kfree's the pointer and NULLs it, matching the one-shot funcs->destroy(&link->link_enc) in dc_link.c:87 / dc_link.c:1249. No double-free/UAF path.

Also noted (latent, not filed): create_links() bounds only connectors_num against ENUM_ID_COUNT (dc.c:105-112) but writes dc->links[MAX_PIPES*2] (dc.h:287) connectors_num + num_virtual_links times — harmless only because num_virtual_links is hardcoded 0. And the virtual_link_encoder_construct() return value is ignored at dc.c:169 (always true today, benign).

Fix

Add no-op stubs for the six missing ops:

--- a/sys/dev/drm/amd/display/dc/virtual/virtual_link_encoder.c
+++ b/sys/dev/drm/amd/display/dc/virtual/virtual_link_encoder.c
@@ static void virtual_link_encoder_connect_dig_be_to_fe(
    struct link_encoder *enc,
    enum engine_id engine,
    bool connect) {}

+static void virtual_link_encoder_enable_lvds_output(
+   struct link_encoder *enc,
+   enum clock_source_id clock_source,
+   uint32_t pixel_clock) {}
+
+static void virtual_link_encoder_psr_program_dp_dphy_fast_training(
+   struct link_encoder *enc,
+   bool exit_link_training_required) {}
+
+static void virtual_link_encoder_psr_program_secondary_packet(
+   struct link_encoder *enc,
+   unsigned int sdp_transmit_line_num_deadline) {}
+
+static void virtual_link_encoder_enable_hpd(struct link_encoder *enc) {}
+
+static void virtual_link_encoder_disable_hpd(struct link_encoder *enc) {}
+
+static bool virtual_link_encoder_is_dig_enabled(struct link_encoder *enc)
+{
+   return true;
+}
+
 static void virtual_link_encoder_destroy(struct link_encoder **enc)
 {
    kfree(*enc);
@@ static const struct link_encoder_funcs virtual_lnk_enc_funcs = {
    .enable_dp_mst_output = virtual_link_encoder_enable_dp_mst_output,
+   .enable_lvds_output = virtual_link_encoder_enable_lvds_output,
    .disable_output = virtual_link_encoder_disable_output,
    .dp_set_lane_settings = virtual_link_encoder_dp_set_lane_settings,
    .dp_set_phy_pattern = virtual_link_encoder_dp_set_phy_pattern,
    .update_mst_stream_allocation_table =
        virtual_link_encoder_update_mst_stream_allocation_table,
+   .psr_program_dp_dphy_fast_training =
+       virtual_link_encoder_psr_program_dp_dphy_fast_training,
+   .psr_program_secondary_packet =
+       virtual_link_encoder_psr_program_secondary_packet,
    .connect_dig_be_to_fe = virtual_link_encoder_connect_dig_be_to_fe,
+   .enable_hpd = virtual_link_encoder_enable_hpd,
+   .disable_hpd = virtual_link_encoder_disable_hpd,
+   .is_dig_enabled = virtual_link_encoder_is_dig_enabled,
    .destroy = virtual_link_encoder_destroy
 };

Why not runtime-verified

Info/latent finding on a dead path (no AMD GPU on the guest; num_virtual_links == 0 tree-wide). Phase V skipped per contract; verdict.json records status: untested, attempts: 0.

Fix status (batch validation)

Applied with the 36 sibling fix.diffs of this batch in findings/poc/_batch41/all_fixes.patch; single in-guest make -j6 nativekernel KERNCONF=X86_64_GENERIC completed RC=0 with zero errors under -Werror (full log: findings/poc/_batch41/fix_build8.log). Behavior A/B intentionally skipped for this Info-tier item.

(No fix.diff for this item: documented recommendation only - see Fix above.)