# DF-1153 — Use-After-Free in amdgpu_dm reset functions on OOM

## Result
**NOT REPRODUCED** on this guest. Real source-level defense-in-depth bug;
fix authored.  See `VERDICT.md` for the full analysis.

## Build & run
```
./build.sh    # documents why no executable PoC is possible
./run.sh      # documents why runtime trigger is impossible
```

## Reachability summary
- amdgpu_dm is part of amdgpu, **not** in `X86_64_GENERIC` (0 symbols)
- No AMD GPU on the QEMU guest, no `/dev/dri`
- Trigger needs memory pressure during DRM atomic reset on AMD hardware

## Fix
`fix.diff` — assign `NULL` to `*->state` on the OOM path of all three
reset functions (`amdgpu_dm_connector_funcs_reset`, `dm_crtc_reset_state`,
`dm_drm_plane_reset`) at `sys/dev/drm/amd/display/amdgpu_dm/amdgpu_dm.c`.
Applies cleanly with `git apply`.