{
  "finding_id": "DF-3763",
  "verdict": "inconclusive",
  "reproduced": 0,
  "impact": "panic",
  "confidence": "certain",
  "reproduce": {
    "build": "cc -Wall -O2 -o df3763_cube_null df3763_cube_null.c",
    "run": "./df3763_cube_null /dev/dri/renderD128",
    "expected": "panic (DF-3763) / dmesg NUM_VERTICES leak (DF-3764) / ioctl returns 0 = bypass (DF-3765/3766)"
  },
  "kernel_refs": [
    "sys/dev/drm/radeon/r100.c:2134-2163 (r100_cs_track_cube, no NULL check on cube_info[face].robj)",
    "sys/dev/drm/radeon/r100.c:2225-2228 (separate_cube path reaches it)",
    "sys/dev/drm/radeon/r100.c:1842-1843 (CUBIC_MAP_ENABLE sets tex_coord_type=2)",
    "sys/dev/drm/radeon/r100.c:2451-2457 (cube_info[face].robj initialized NULL and never required)",
    "sys/dev/drm/radeon/r100.c:2400 (separate_cube=1 for all pre-R300 asics)",
    "sys/dev/drm/radeon/radeon_kms.c:912 (CS ioctl gate: DRM_AUTH|DRM_RENDER_ALLOW)"
  ],
  "artifacts": [
    "df3763_cube_null.c",
    "build.sh",
    "run.sh",
    "build.log",
    "run.log",
    "env.txt",
    "fix.diff",
    "VERDICT.md",
    "manifest.json",
    "verdict.json"
  ]
}