{
  "finding_id": "DF-3791",
  "status": "inconclusive",
  "reproduced": 0,
  "impact": "none",
  "confidence": "certain",
  "verdict": "Source-level certain, runtime-inconclusive: sys/dev/drm/drm_atomic_helper.c:325 lacks the !state->duplicated guard added by upstream commit 022debad063e (v5.2), and the duplicated flag does not exist in this trees drm_atomic_state at all; drm_atomic_helper_resume() (used by amdgpu_dm.c:908 and i915) therefore fails with -EINVAL whenever a connector is unregistered during suspend, leaving all outputs off after resume (availability only, no memory corruption). The QEMU guest has no DRM-capable GPU (QEMU std VGA 0x1111:1234, no virtio_gpu/std-VGA driver in tree, drm.ko unloaded, /dev/dri absent), so the trigger cannot be executed on this guest.",
  "exploit_chain": "",
  "evidence": "VERDICT.md (diff-vs-upstream proof); README.md (trigger narrative); sys/dev/drm/drm_atomic_helper.c:325-329 (missing guard), :3840-3901 (duplicate_state sets no flag), :3230-3258 (commit_duplicated_state -> drm_atomic_commit -> check); amdgpu_dm.c:710/:908 and intel_display.c:6381 (suspend/resume users); env.txt (guest GPU/module survey)",
  "kernel_refs": [
    "sys/dev/drm/drm_atomic_helper.c:325",
    "sys/dev/drm/drm_atomic_helper.c:3840",
    "sys/dev/drm/drm_atomic_helper.c:3252",
    "sys/dev/drm/amd/display/amdgpu_dm/amdgpu_dm.c:710",
    "sys/dev/drm/amd/display/amdgpu_dm/amdgpu_dm.c:908",
    "sys/dev/drm/i915/intel_display.c:6381"
  ],
  "poc_changes": "No PoC source produced: trigger requires physical GPU hardware with hot-pluggable displays (DP/MST). Guest is virtio-only with no DRM driver; verification is source-level (upstream fix commit diff).",
  "attempts": 0,
  "guest_uname": "DragonFly dfbsd 6.5-DEVELOPMENT DragonFly 6.5-DEVELOPMENT #0: Thu Jul  2 06:02:54 UTC 2026 root@dfbsd:/usr/obj/usr/src/sys/X86_64_GENERIC x86_64",
  "runtime_sec": 0,
  "guest_dirty": 0,
  "build_cmd": "",
  "run_cmd": "",
  "code_hash": "",
  "notes": "Pass-2 finding (GLM 5.3). Carried upstream bug: 022debad063e drm/atomic: Add drm_atomic_state->duplicated. Impact class is dos at source level (Low); runtime impact recorded none because it could not be executed on this guest. Guest check performed: /dev/dri absent, kldstat has no drm, pciconf shows only QEMU std VGA.",
  "recommended_fix": "Backport upstream 022debad063e: add drm_atomic_state.duplicated, set it in drm_atomic_helper_duplicate_state(), and gate the unregistered-connector check in update_connector_routing() (fix.diff in this pack).",
  "fix_status": "not_testable",
  "fix_baseline_reproduced": 0,
  "fix_patched_reproduced": 0,
  "fix_verdict": "No DRM device on the guest, so no kernel could be built/run against the buggy or patched path; fix is a straight backport of the upstream-accepted commit 022debad063e.",
  "fix_evidence": "findings/poc/DF-3791/fix.diff (git-apply-able vs this tree, authored post-verification, never applied to sys/)."
}