{
  "finding_id": "DF-3862",
  "title": "amdgpu_device_gpu_recover dereferences the timed-out job after the fence-completion path can kfree it (UAF, concurrent-reinit family)",
  "verdict": "not_reproduced",
  "reproduce": {
    "build": "cc -Wall -O2 -o tdr_race tdr_race.c -lpthread (builds clean on guest, RC=0)",
    "run": "./tdr_race (needs AMD hw + amdgpu.gpu_recovery=1 + GPU hang racing job completion)",
    "expected": "UAF read of job->base.sched at amdgpu_device.c:3414/3438 during/after amdgpu_device_reset; panic or scheduler mis-steer with slab grooming"
  },
  "kernel_refs": ["sys/dev/drm/amd/amdgpu/amdgpu_device.c:3388", "sys/dev/drm/amd/amdgpu/amdgpu_device.c:3414", "sys/dev/drm/amd/amdgpu/amdgpu_device.c:3417", "sys/dev/drm/amd/amdgpu/amdgpu_device.c:3420", "sys/dev/drm/amd/amdgpu/amdgpu_device.c:3438", "sys/dev/drm/scheduler/sched_main.c:266", "sys/dev/drm/scheduler/sched_main.c:271", "sys/dev/drm/scheduler/sched_main.c:220", "sys/dev/drm/amd/amdgpu/amdgpu_job.c:110"],
  "artifacts": ["README.md", "VERDICT.md", "tdr_race.c", "build.sh", "run.sh", "build.log", "run.log", "env.txt", "fix.diff", "manifest.json", "verdict.json"]
}