{
  "finding_id": "DF-3655",
  "status": "inconclusive",
  "reproduced": 0,
  "impact": "none",
  "confidence": "certain",
  "verdict": "Source-certain evaluation-order defect, hardware-gated runtime. amdgpu_dm_atomic_commit_tail() at amdgpu_dm.c:4888-4890 does `status = dc_stream_get_status(stream); WARN_ON(!status); WARN_ON(!status->plane_count);` \u2014 WARN_ON reports but does not stop control flow, so a NULL status (stream absent from the current DC context, e.g. right after the tolerated dc_commit_state() failure warned at amdgpu_dm.c:4837) is dereferenced at line 4890, reading offsetof(struct dc_stream_status, plane_count) = 8 \u2192 page fault \u2192 panic. Trigger is two-step: userspace-chosen loop entry (underscan-only atomic commit on a live CRTC, DRM master) plus an internal DC condition making the status lookup fail, hence Low severity. On-guest harness with the verbatim struct layout prints WARN_ON(!status)=1 then SIGSEGVs at offset 8 (run.log EXIT=139); the kernel path itself cannot run \u2014 guest is virtio-only with no AMD GPU (env.txt).",
  "exploit_chain": "DRM-master atomic commit that changes only underscan properties on a connector whose CRTC holds a stream that is not present in the DC current context (after a warned-but-tolerated dc_commit_state failure) -> WARN_ON(!status) fires without effect -> status->plane_count loads from NULL+8 -> kernel panic (local DoS).",
  "evidence": "run.log (WARN_ON printed, then SIGSEGV EXIT=139 at offset 8); VERDICT.md (evaluation-order trace + 4837 linkage); fix.diff (NULL status -> DC_ERR + continue; git apply --check clean); env.txt",
  "kernel_refs": [
    "sys/dev/drm/amd/display/amdgpu_dm/amdgpu_dm.c:4888",
    "sys/dev/drm/amd/display/amdgpu_dm/amdgpu_dm.c:4890",
    "sys/dev/drm/amd/display/amdgpu_dm/amdgpu_dm.c:4837"
  ],
  "poc_changes": "no seeded PoC for pass-2; harness written fresh \u2014 WARN_ON macro modeled with printf+fflush so the pre-fault warning is captured (kernel WARN prints before the fault)",
  "attempts": 2,
  "guest_uname": "DragonFly dfbsd 6.5-DEVELOPMENT DragonFly 6.5-DEVELOPMENT #0: Thu Jul  2 06:02:54 UTC 2026     root@dfbsd:/usr/obj/usr/src/sys/X86_64_GENERIC  x86_64",
  "runtime_sec": 40,
  "guest_dirty": 0,
  "build_cmd": "cc -O2 -Wall -o harness harness.c",
  "run_cmd": "./harness",
  "code_hash": "3b52afa4d3d242260df57eee5d0c7dfd927e05160170e0d836f429468d2e3166",
  "notes": "pass 2 amdgpu_dm.c; adjacent block to DF-3653 but independent guard defect (status NULL vs stream NULL); guest scratch removed",
  "recommended_fix": "Replace the WARN_ON(!status); WARN_ON(!status->plane_count); pair with an explicit `if (!status) { DC_ERR(...); continue; }` before any dereference.",
  "fix_status": "not_testable",
  "fix_baseline_reproduced": 0,
  "fix_patched_reproduced": 0,
  "fix_verdict": "Hardware-gated (needs amdgpu display + DC commit failure to seed status==NULL). fix.diff converts the first WARN_ON into an early continue; git apply --check verified against sys/; not applied (read-only audit target).",
  "fix_evidence": "fix.diff in this pack"
}