BUILD_EXIT=0
=== DF-1749 amdgpu_acpi UAF: notify handler never removed ===
  init: AcpiInstallNotifyHandler(handler, adev=0x8004a01b8)
  fini (buggy): AcpiOsFree(adev->atif) only; ACPICA retains adev=0x8004a01b8
  [underlying adev freed by amdgpu_device_fini+kfree]
  event: dereferencing adev=0x8004a01b8 (UAF), adev->atif_enabled=1

VERDICT: BUG CONFIRMED. registered_adev still points at freed
        memory after fini; the next ACPI notify event calls
        amdgpu_acpi_event with the dangling context. Reading
        adev->atif (line 369) is a UAF; with heap grooming it
        yields attacker-controlled atif->notification_cfg and
        function pointers -> kCE.
RUN_EXIT=0