The Libre Tea Computer Card is a single-board computer that comes without any proprietary software (at least that’s the goal, it’s currently in crowdfunding):
[…] all firmware and kernel sources are GPL-licensed and will always remain so, and have been vetted in advance and do not contain any copyright violations or proprietary license-violating blobs (an extremely common practice nowadays).
It uses the Allwinner A20 as SoC, which uses Mali400 as GPU. There doesn’t seem to exist a working free/libre driver for Mali400, so this GPU will (by default) not be used in the Libre Tea Computer Card:
[…] it turns out that the MALI GPU is entirely memory-mapped. if you try to do "lsusb" or "cat /proc/cpuinfo" or any other kind of exploration from userspace, if you haven't compiled up mali.ko you LITERALLY cannot even SEE the MALI GPU from userspace. guess what we will not be doing? :) we will not be adding CONFIG_MALI=y to the linux kernel build process. thus, it becomes literally impossible for the average end-user to accidentally end up installing the proprietary non-free MALI 3D GPU code.
Let’s assume the user does not intend to use the Mali GPU, so the user does not add support for it when compiling the kernel.
Is there any security risk in having this "dead" GPU?
Could it contain and run code that does something on its own (e.g., reading/manipulating/sending the user’s data), or has the OS full control over it?