{
  "finding_id": "DF-3792",
  "status": "inconclusive",
  "reproduced": 0,
  "impact": "none",
  "confidence": "certain",
  "verdict": "Source-level certain, runtime-inconclusive, Info severity: sys/dev/drm/drm_atomic_helper.c:1011-1014 calls funcs->dpms() unconditionally when prepare/atomic_disable/disable are all NULL, :1257-1260 calls funcs->commit() unconditionally when atomic_enable is NULL, and :461-463/:1007 dereference crtc->helper_private without a !funcs guard \u2014 all three guards were added upstream by fe6169288666 and 26564be56d73 (v5.2 window) and are missing from this ~v5.0-rc snapshot. In-tree drivers cannot trigger it (i915 and amdgpu_dm use their own commit tails; classic DCE/radeon set the hooks), so impact is limited to out-of-tree/future drivers with partial crtc helper tables: a NULL function-pointer call, i.e. kernel panic/DoS, not attacker-controlled IP. Guest has no DRM device at all (QEMU std VGA, no driver, /dev/dri absent), so nothing could be executed.",
  "exploit_chain": "",
  "evidence": "VERDICT.md; README.md (in-tree reachability survey); fix.diff; env evidence in findings/poc/DF-3791/env.txt",
  "kernel_refs": [
    "sys/dev/drm/drm_atomic_helper.c:1011",
    "sys/dev/drm/drm_atomic_helper.c:1257",
    "sys/dev/drm/drm_atomic_helper.c:461",
    "sys/dev/drm/drm_atomic_helper.c:1007",
    "sys/dev/drm/i915/intel_display.c:10939",
    "sys/dev/drm/amd/display/amdgpu_dm/amdgpu_dm.c:3403"
  ],
  "poc_changes": "No PoC produced: triggering requires a DRM driver with a partial crtc helper table; none exists in-tree and no DRM device exists on the guest.",
  "attempts": 0,
  "guest_uname": "DragonFly dfbsd 6.5-DEVELOPMENT DragonFly 6.5-DEVELOPMENT #0: Thu Jul  2 06:02:54 UTC 2026 root@dfbsd:/usr/obj/usr/src/sys/X86_64_GENERIC x86_64",
  "runtime_sec": 0,
  "guest_dirty": 0,
  "build_cmd": "",
  "run_cmd": "",
  "code_hash": "",
  "notes": "Pass-2 finding (GLM 5.3). Carried upstream robustness fixes: fe6169288666 (drm/atomic-helper: Make atomic_enable/disable crtc callbacks optional) and 26564be56d73 (drm/atomic-helper: Make crtc helper funcs optional). NULL callback call = panic only.",
  "recommended_fix": "Backport the three NULL guards (see fix.diff in this pack).",
  "fix_status": "not_testable",
  "fix_baseline_reproduced": 0,
  "fix_patched_reproduced": 0,
  "fix_verdict": "No DRM device / no triggering driver on the guest; guards are a straight backport of upstream-accepted fixes.",
  "fix_evidence": "findings/poc/DF-3792/fix.diff (git-apply-able vs this tree, authored post-verification, never applied to sys/)."
}