DF-5232
dml_init_instance's default branch is ASSERT-only (WARN_ON) and still commits lib->project with no bounding box loaded β latent invalid-state commit that would feed the dml_log2(0)/Γ·0 family (DF-4198) if a future project value lacks a case
Summary
set_soc_bounding_box/set_ip_params default branches only WARN_ON and fall through; dml_init_instance unconditionally commits lib->project and returns void - success-by-construction. A future enum member without a case yields all-zero boxes (kzalloc dc) driving dml_log2(0) UB-shift and zero-buffer arithmetic in the RQ/DLG math (same terminal family as DF-4198). Dead today: enum has only UNDEFINED/RAVEN1 and the sole caller passes the RAVEN1 constant. total-or-fail bool fix.
Discussion (0)
PoC verification
Evidence pack
findings/poc/DF-5232 Β· 1 files| File | Type | Description | Size | |
|---|---|---|---|---|
| verdict.json | file | 921 B | view raw |
Fix verification
not_testablebaseline noβ patch + rebuild βpatched clean
per-fix-DF-5232
Confirmed kernel references
Detail
Evidence (decisive lines)
static reachability proof in finding markdown
Verified recommended fix
see finding markdown
Verdict
untested (Info hardening; provably unreachable trigger)
No comments yet.