[Power Display] Built-in monitor blacklist to mitigate DDC/CI BSOD (#47556, #47968) (#48051)

<!-- Enter a brief description/summary of your PR here. What does it
fix/what does it change/how was it tested (even manually, if necessary)?
-->
## Summary of the Pull Request

Adds a built-in monitor blacklist that skips known-bad monitor models at
the DDC/CI discovery stage — before PowerDisplay sends any capabilities
request to the firmware. Matches by EdidId (the PnP manufacturer +
product code from EDID). Two entries pre-populated from existing crash
reports:

| EdidId | Reported in | Notes |

|-----------|-------------|------------------------------------------------------------------------|
| `LTM2C02` | #47556 | Counterfeit-EDID LG 27MR400 (PnP claims Litemax
40" 2011, actual hw is LG 27" 2024) |
| `GSM7714` | #47968 | LG UltraWide HDR WFHD |

Also logs `[EdidId=…] [FriendlyName=…] [DevicePath=…]` immediately
before each `GetCapabilitiesString*` syscall in `DdcCiController`. If
the kernel call BSODs (`win32kfull` stack-cookie overrun), that is the
last log line that survives — adding a new blacklist entry then takes
one PR to `BuiltInMonitorBlacklist.json` instead of a memory-dump
triage.

<!-- Please review the items on the PR checklist before submitting-->
## PR Checklist

- [x] Mitigates: #47556
- [x] Mitigates: #47968
- [x] **Communication:** This is the "Add blacklist and prevent the API
call on broken monitor" mitigation outlined in [#47556
(comment)](#47556 (comment)).
The underlying `win32kfull!DdcciGetCapabilitiesStringFromMonitor` stack
overrun is tracked separately by the Windows team.
- [x] **Tests:** 6 new MSTest unit tests under
`PowerDisplay.Lib.UnitTests`. All 120 PowerDisplay tests pass on x64
Debug.
- [ ] **Localization:** N/A — this PR ships no end-user-facing strings
(no UI surface).
- [ ] **Dev docs:** N/A.
- [ ] **New binaries:** N/A. Data ships as an `<EmbeddedResource>`
inside the existing `PowerDisplay.Models.dll`; no new .dll, no installer
change.
- [ ] **Documentation updated:** N/A.

<!-- Provide a more detailed description of the PR, other things fixed,
or any additional comments/features here -->
## Detailed Description of the Pull Request / Additional comments

### Threat model

Some retail monitor firmwares ship non-conformant DDC/CI capabilities
strings — typically oversized, not NUL-terminated, or otherwise
malformed. When PowerDisplay calls `GetCapabilitiesStringLength` /
`CapabilitiesRequestAndCapabilitiesReply` on these monitors, the request
flows into
`win32kfull!CPhysicalMonitorHandle::DdcciGetCapabilitiesStringFromMonitor`,
which copies the reply into a stack buffer without bounding the length.
The kernel detects its own stack cookie corruption on the epilogue check
and `__fastfail`s with `BUGCHECK 0x139 / 2
(STACK_COOKIE_CHECK_FAILURE)`.

The kernel-side overrun is a Windows defect, not PowerDisplay's, but
PowerDisplay is currently the most widely deployed consumer of this API
on hot-plug. Until the Windows team fixes the kernel, the only safe
mitigation in user space is to **never call** the capabilities API on
monitor models known to trigger it.

### Architecture

| File | Role |
|---|---|
| `PowerDisplay.Models/MonitorBlacklistEntry.cs` | POCO: `{ edidId,
comments }` |
| `PowerDisplay.Models/BuiltInMonitorBlacklist.json` | Data file
(embedded resource) |
| `PowerDisplay.Models/BuiltInMonitorBlacklist.cs` | Lazy-loaded reader,
AOT-safe (source-gen `JsonSerializerContext`); silent fallback to empty
list on any IO/parse failure |
| `PowerDisplay.Lib/Services/MonitorBlacklistService.cs` |
`IsBlocked(monitorId)` — extracts EdidId via
`MonitorIdentity.EdidIdFromMonitorId`, checks a `HashSet<string>` with
`OrdinalIgnoreCase` |
| `PowerDisplay/Helpers/MonitorManager.cs` | Filters QueryDisplayConfig
inventory by EdidId **before** any controller (DDC/CI or WMI) is
dispatched; logs each skip with `[MonitorBlacklist] Skipping ...` |
| `PowerDisplay.Lib/Drivers/DDC/DdcCiController.cs` | Logs EdidId +
FriendlyName + DevicePath immediately before the first capabilities
syscall per-monitor |

Matching is **model-level granularity** (EdidId, e.g. `GSM7714`) rather
than device-level (full DevicePath). One entry covers every physical
port and every machine with the same monitor model.

### Adding new entries

Once the kernel overrun is fixed this list can shrink. Until then, when
a new BSOD surfaces:

1. User reports BSOD, attaches PowerDisplay log
2. The last line before the crash now reads `DDC: probing capabilities
[EdidId=XXXXXX] [FriendlyName='...'] [DevicePath=...]`
3. Add `{ "edidId": "XXXXXX", "comments": "See #issue" }` to
`BuiltInMonitorBlacklist.json`
4. Submit PR, ship in next release

### Scoped out (deliberate)

A user-customized blacklist surface (Settings UI dialog) was prototyped
and hit multiple WinUI 3 dialog parse / measure crashes inside a
`ContentDialog`. The custom-list code path was reverted in favor of
"built-in only" for v1 reliability. UI can be re-added later on top of
this foundation if needed — the data model and service already support
it.

<!-- Describe how you validated the behavior. Add automated tests
wherever possible, but list manual validation steps taken as well -->
## Validation Steps Performed

1. **Unit tests:** `dotnet test` on `PowerDisplay.Lib.UnitTests` →
**120/120 pass** (including 6 new tests for loader + service: built-in
JSON loads, EdidIds are normalized to upper-case, no blank entries,
`Lazy<>` cache returns same instance, `IsBlocked` returns `false` for
empty built-in list and for unidentifiable monitor IDs).
2. **Clean x64 Debug build** via `tools\build\build-essentials.cmd` +
per-project `tools\build\build.cmd`:
   - `PowerDisplay.Models` — 0 warning, 0 error
   - `PowerDisplay.Lib` — 0 warning, 0 error
   - `PowerDisplay` (app) — 0 warning, 0 error
3. **Smoke test (manual):** launched PowerDisplay, confirmed every
connected monitor produces a `DDC: probing capabilities [EdidId=…]
[FriendlyName=…] [DevicePath=…]` log line right before its caps request.
4. **Empty-list case:** `BuiltInMonitorBlacklist.json` with no entries →
`IsBlocked` returns `false` for any input (verified via unit test).
5. **Non-empty case (manual):** temporarily added a connected monitor's
EdidId to the built-in JSON → that monitor disappears from
`MonitorManager.Monitors` and `[MonitorBlacklist] Skipping ...` log line
appears; removed the entry → monitor reappears, all per-monitor settings
intact.

---------

Co-authored-by: Yu Leng (from Dev Box) <yuleng@microsoft.com>

Author: moooyo

.github/actions/spell-check/expect.txt

@@ -954,6 +954,7 @@ keynum
 keyremaps
 keyring
 keyvault
+kfull
 KILLFOCUS
 killrunner
 kmph
@@ -1061,6 +1062,7 @@ lstrcmpi
 lstrcpyn
 lstrlen
 LTEXT
+LTM
 LTRREADING
 luid
 LUMA

src/modules/powerdisplay/PowerDisplay.Lib.UnitTests/BuiltInMonitorBlacklistTests.cs

@@ -0,0 +1,54 @@
+// Copyright (c) Microsoft Corporation
+// The Microsoft Corporation licenses this file to you under the MIT license.
+// See the LICENSE file in the project root for more information.
+
+using System.Linq;
+using Microsoft.VisualStudio.TestTools.UnitTesting;
+using PowerDisplay.Models;
+
+namespace PowerDisplay.UnitTests;
+
+[TestClass]
+public class BuiltInMonitorBlacklistTests
+{
+    [TestMethod]
+    public void Entries_LoadsWithoutThrowing()
+    {
+        var entries = BuiltInMonitorBlacklist.Entries;
+
+        Assert.IsNotNull(entries);
+    }
+
+    [TestMethod]
+    public void Entries_AreNormalizedToUpperCase()
+    {
+        foreach (var entry in BuiltInMonitorBlacklist.Entries)
+        {
+            Assert.AreEqual(
+                entry.EdidId,
+                entry.EdidId.ToUpperInvariant(),
+                $"Entry '{entry.EdidId}' is not normalized to uppercase.");
+            Assert.AreEqual(
+                entry.EdidId.Trim(),
+                entry.EdidId,
+                $"Entry '{entry.EdidId}' has untrimmed whitespace.");
+        }
+    }
+
+    [TestMethod]
+    public void Entries_ContainNoEmptyEdidIds()
+    {
+        Assert.IsFalse(
+            BuiltInMonitorBlacklist.Entries.Any(e => string.IsNullOrWhiteSpace(e.EdidId)),
+            "Built-in list should never contain blank EdidId entries.");
+    }
+
+    [TestMethod]
+    public void Entries_AreCached()
+    {
+        var first = BuiltInMonitorBlacklist.Entries;
+        var second = BuiltInMonitorBlacklist.Entries;
+
+        Assert.AreSame(first, second, "Entries should be returned from a cached Lazy<>.");
+    }
+}

src/modules/powerdisplay/PowerDisplay.Lib.UnitTests/MonitorBlacklistServiceTests.cs

@@ -0,0 +1,36 @@
+// Copyright (c) Microsoft Corporation
+// The Microsoft Corporation licenses this file to you under the MIT license.
+// See the LICENSE file in the project root for more information.
+
+using Microsoft.VisualStudio.TestTools.UnitTesting;
+using PowerDisplay.Common.Services;
+
+namespace PowerDisplay.UnitTests;
+
+[TestClass]
+public class MonitorBlacklistServiceTests
+{
+    private const string SamplePathDel = @"\\?\DISPLAY#DELD1A8#5&abc123&0&UID12345#{e6f07b5f-ee97-4a90-b076-33f57bf4eaa7}";
+    private const string SamplePathBoe = @"\\?\DISPLAY#BOE0900#4&xyz&0&UID0";
+
+    [TestMethod]
+    public void IsBlocked_EmptyBuiltIn_ReturnsFalse()
+    {
+        // Built-in list ships empty in this release, so the service should never block.
+        var service = new MonitorBlacklistService();
+
+        Assert.IsFalse(service.IsBlocked(SamplePathDel));
+        Assert.IsFalse(service.IsBlocked(SamplePathBoe));
+    }
+
+    [TestMethod]
+    public void IsBlocked_EmptyOrUnknownMonitorId_ReturnsFalse()
+    {
+        var service = new MonitorBlacklistService();
+
+        Assert.IsFalse(service.IsBlocked(string.Empty));
+        Assert.IsFalse(service.IsBlocked(null!));
+        Assert.IsFalse(service.IsBlocked(@"\\?\DISPLAY"));
+        Assert.IsFalse(service.IsBlocked(@"garbage no hashes here"));
+    }
+}

src/modules/powerdisplay/PowerDisplay.Lib/Drivers/DDC/DdcCiController.cs

@@ -703,6 +703,16 @@ private async Task<IReadOnlyList<Monitor>> DiscoverFromHandleAsync(
                     }
 #endif
 
+                    // Log identity of the monitor we are about to touch via DDC/CI BEFORE the
+                    // first syscall. If the call triggers a kernel stack-cookie overrun inside
+                    // win32kfull (see GH #47556 / #47968), this is the last log line that
+                    // survives — it has to carry enough to identify the offending hardware:
+                    // EdidId for blacklist matching, plus the human-readable name and full
+                    // DevicePath.
+                    var edidId = MonitorIdentity.EdidIdFromMonitorId(info.DevicePath);
+                    Logger.LogInfo(
+                        $"DDC: probing capabilities [EdidId={edidId}] [FriendlyName='{info.FriendlyName}'] [DevicePath={info.DevicePath}]");
+
                     // Async caps fetch (retry + max-compat probe). Awaits Task.Delay between
                     // retries instead of blocking the threadpool.
                     var (capsString, caps) = await FetchCapabilitiesWithFallbackAsync(

src/modules/powerdisplay/PowerDisplay.Lib/Services/MonitorBlacklistService.cs

@@ -0,0 +1,59 @@
+// Copyright (c) Microsoft Corporation
+// The Microsoft Corporation licenses this file to you under the MIT license.
+// See the LICENSE file in the project root for more information.
+
+using System;
+using System.Collections.Generic;
+using PowerDisplay.Common.Models;
+using PowerDisplay.Models;
+
+namespace PowerDisplay.Common.Services
+{
+    /// <summary>
+    /// Decides whether a monitor identified by its <c>Monitor.Id</c> (or raw DevicePath)
+    /// should be filtered out of PowerDisplay's discovery. Matches on EdidId only —
+    /// model-level granularity, so a single entry covers every physical port and every
+    /// machine with the same monitor model.
+    /// </summary>
+    /// <remarks>
+    /// Only the built-in list shipped with PowerToys is consulted; user-customized
+    /// blacklists were considered but cut due to UI cost. EdidIds are normalized
+    /// (trimmed, upper-cased) on construction; comparisons use
+    /// <see cref="StringComparer.OrdinalIgnoreCase"/> as defense in depth.
+    /// </remarks>
+    public sealed class MonitorBlacklistService
+    {
+        private readonly HashSet<string> _blockedEdidIds;
+
+        public MonitorBlacklistService()
+        {
+            _blockedEdidIds = new HashSet<string>(StringComparer.OrdinalIgnoreCase);
+
+            foreach (var entry in BuiltInMonitorBlacklist.Entries)
+            {
+                AddNormalized(entry.EdidId);
+            }
+        }
+
+        /// <summary>
+        /// Returns true if <paramref name="monitorId"/> (a <c>Monitor.Id</c> or raw Windows
+        /// DevicePath) has an EdidId in the built-in blacklist. Monitors whose EdidId cannot
+        /// be extracted (empty path, malformed) are never blocked — we only filter what we
+        /// can positively identify.
+        /// </summary>
+        public bool IsBlocked(string monitorId)
+        {
+            var edid = MonitorIdentity.EdidIdFromMonitorId(monitorId);
+            return !string.IsNullOrEmpty(edid) && _blockedEdidIds.Contains(edid);
+        }
+
+        private void AddNormalized(string? edidId)
+        {
+            var trimmed = edidId?.Trim();
+            if (!string.IsNullOrEmpty(trimmed))
+            {
+                _blockedEdidIds.Add(trimmed.ToUpperInvariant());
+            }
+        }
+    }
+}

src/modules/powerdisplay/PowerDisplay.Models/BuiltInMonitorBlacklist.cs

@@ -0,0 +1,76 @@
+// Copyright (c) Microsoft Corporation
+// The Microsoft Corporation licenses this file to you under the MIT license.
+// See the LICENSE file in the project root for more information.
+
+using System;
+using System.Collections.Generic;
+using System.IO;
+using System.Linq;
+using System.Reflection;
+using System.Text.Json;
+
+namespace PowerDisplay.Models
+{
+    /// <summary>
+    /// Loads the built-in monitor blacklist shipped with PowerToys.
+    /// The data is an embedded JSON resource in this assembly; the file is read once
+    /// on first access and cached for the lifetime of the process.
+    /// </summary>
+    /// <remarks>
+    /// Loader failures are non-fatal: on any exception (missing resource, malformed
+    /// JSON, etc.) the loader returns an empty list. This keeps PowerDisplay running
+    /// even if a malformed release ships, and avoids logging dependencies inside the
+    /// AOT-compatible PowerDisplay.Models assembly.
+    /// </remarks>
+    public static class BuiltInMonitorBlacklist
+    {
+        private const string ResourceName = "PowerDisplay.Models.BuiltInMonitorBlacklist.json";
+
+        private static readonly Lazy<IReadOnlyList<MonitorBlacklistEntry>> _entries
+            = new(LoadFromResource);
+
+        public static IReadOnlyList<MonitorBlacklistEntry> Entries => _entries.Value;
+
+        private static IReadOnlyList<MonitorBlacklistEntry> LoadFromResource()
+        {
+            try
+            {
+                var assembly = typeof(BuiltInMonitorBlacklist).Assembly;
+                using var stream = assembly.GetManifestResourceStream(ResourceName);
+                if (stream == null)
+                {
+                    return Array.Empty<MonitorBlacklistEntry>();
+                }
+
+                var file = JsonSerializer.Deserialize(
+                    stream,
+                    MonitorBlacklistSerializationContext.Default.BuiltInMonitorBlacklistFile);
+
+                if (file?.Entries == null)
+                {
+                    return Array.Empty<MonitorBlacklistEntry>();
+                }
+
+                // Only the v1 schema is understood by this build. Future versions
+                // ship a refreshed binary that updates this check.
+                if (file.Version != 1)
+                {
+                    return Array.Empty<MonitorBlacklistEntry>();
+                }
+
+                return file.Entries
+                    .Where(e => !string.IsNullOrWhiteSpace(e.EdidId))
+                    .Select(e => new MonitorBlacklistEntry
+                    {
+                        EdidId = e.EdidId.Trim().ToUpperInvariant(),
+                        Comments = e.Comments ?? string.Empty,
+                    })
+                    .ToList();
+            }
+            catch
+            {
+                return Array.Empty<MonitorBlacklistEntry>();
+            }
+        }
+    }
+}

src/modules/powerdisplay/PowerDisplay.Models/BuiltInMonitorBlacklist.json

@@ -0,0 +1,13 @@
+{
+  "version": 1,
+  "entries": [
+    {
+      "edidId": "LTM2C02",
+      "comments": "See https://github.com/microsoft/PowerToys/issues/47556"
+    },
+    {
+      "edidId": "GSM7714",
+      "comments": "See https://github.com/microsoft/PowerToys/issues/47968"
+    }
+  ]
+}

src/modules/powerdisplay/PowerDisplay.Models/BuiltInMonitorBlacklistFile.cs

@@ -0,0 +1,23 @@
+// Copyright (c) Microsoft Corporation
+// The Microsoft Corporation licenses this file to you under the MIT license.
+// See the LICENSE file in the project root for more information.
+
+using System.Collections.Generic;
+using System.Text.Json.Serialization;
+
+namespace PowerDisplay.Models
+{
+    /// <summary>
+    /// JSON file shape for <see cref="BuiltInMonitorBlacklist"/>.
+    /// The <see cref="Version"/> field is a forward-compatibility marker; this
+    /// release only understands version 1.
+    /// </summary>
+    public class BuiltInMonitorBlacklistFile
+    {
+        [JsonPropertyName("version")]
+        public int Version { get; set; }
+
+        [JsonPropertyName("entries")]
+        public List<MonitorBlacklistEntry> Entries { get; set; } = new();
+    }
+}

src/modules/powerdisplay/PowerDisplay.Models/MonitorBlacklistEntry.cs

@@ -0,0 +1,30 @@
+// Copyright (c) Microsoft Corporation
+// The Microsoft Corporation licenses this file to you under the MIT license.
+// See the LICENSE file in the project root for more information.
+
+using System.Text.Json.Serialization;
+
+namespace PowerDisplay.Models
+{
+    /// <summary>
+    /// One entry in a PowerDisplay monitor blacklist. Used both for the built-in
+    /// list shipped with PowerToys (loaded via <see cref="BuiltInMonitorBlacklist"/>)
+    /// and for the user-editable custom list persisted on <c>PowerDisplayProperties</c>.
+    /// </summary>
+    /// <remarks>
+    /// <para><see cref="EdidId"/> is the 7–8 character PnP hardware identifier extracted
+    /// from a <c>Monitor.Id</c> by <c>MonitorIdentity.EdidIdFromMonitorId</c> (e.g.
+    /// <c>"DELD1A8"</c>, <c>"BOE0900"</c>). It is normalized to uppercase and trimmed
+    /// on write; matching is case-insensitive as a defense-in-depth measure.</para>
+    /// <para><see cref="Comments"/> is free text rendered as-is. The built-in JSON ships
+    /// English-only comments; user input is not localized.</para>
+    /// </remarks>
+    public class MonitorBlacklistEntry
+    {
+        [JsonPropertyName("edidId")]
+        public string EdidId { get; set; } = string.Empty;
+
+        [JsonPropertyName("comments")]
+        public string Comments { get; set; } = string.Empty;
+    }
+}

src/modules/powerdisplay/PowerDisplay.Models/MonitorBlacklistSerializationContext.cs

@@ -0,0 +1,24 @@
+// Copyright (c) Microsoft Corporation
+// The Microsoft Corporation licenses this file to you under the MIT license.
+// See the LICENSE file in the project root for more information.
+
+using System.Collections.Generic;
+using System.Text.Json.Serialization;
+
+namespace PowerDisplay.Models
+{
+    /// <summary>
+    /// JSON serialization context for monitor blacklist types.
+    /// Provides source-generated serialization for Native AOT compatibility.
+    /// </summary>
+    [JsonSourceGenerationOptions(
+        WriteIndented = false,
+        DefaultIgnoreCondition = JsonIgnoreCondition.Never,
+        IncludeFields = true)]
+    [JsonSerializable(typeof(MonitorBlacklistEntry))]
+    [JsonSerializable(typeof(List<MonitorBlacklistEntry>))]
+    [JsonSerializable(typeof(BuiltInMonitorBlacklistFile))]
+    public partial class MonitorBlacklistSerializationContext : JsonSerializerContext
+    {
+    }
+}