DF-1863 / run.log
DF-1863 amdgpu_ctx_add_fence TOCTOU harness (N_THREADS=2, ITERS=4000)
----------------------------------------------------------
BUGGY : iters=8000 double_put=1825 live_fences=1858 occupied_slots=32 leaked=1826
FIXED : iters=8000 double_put=0 live_fences=32 occupied_slots=32 leaked=0
----------------------------------------------------------
RESULT: BUGGY variant produced 1825 double dma_fence_put() events and 1826 leaked fences => confirms TOCTOU primitive.
On the kernel this is a use-after-free / double-free
of struct dma_fence (drm_sched_fence) in kmalloc.