{
  "finding_id": "DF-3862",
  "status": "not_reproduced",
  "reproduced": 0,
  "impact": "none",
  "confidence": "speculative",
  "verdict": "Structural UAF, timing-gated: drm_sched_job_timedout (sched_main.c:266-271) hands the timed-out job to amdgpu_job_timedout -> amdgpu_device_gpu_recover with NO reference held; the async completion chain (drm_sched_process_job -> drm_sched_job_finish sched_main.c:203-227 -> amdgpu_job_free_cb amdgpu_job.c:110-120 -> kfree(job)) can free it while gpu_recover still dereferences job->base.sched at amdgpu_device.c:3414 (every ring) and again at :3438 after the multi-second amdgpu_device_reset; amdgpu_fence_driver_force_completion at :3420 actively pushes jobs toward that free path inside the window. Gated by amdgpu_gpu_recovery=1 (default off on bare metal) plus a hang-vs-completion race; Linux 4.20-era code inherited verbatim. Trigger compiled and ran on the guest: no AMD GPU, no /dev/dri (env.txt) -> TDR path unreachable; honest not_reproduced.",
  "exploit_chain": "hang GPU with amdgpu.gpu_recovery=1 while the timed-out job completes concurrently -> kfree(job) via finish_work during amdgpu_device_reset -> UAF read at :3438; groomed slab reuse forges job->base.sched and steers drm_sched_job_recovery onto arbitrary rings",
  "evidence": "VERDICT.md (full lifetime trace path:line); build.log/run.log (trigger compiles RC=0 on guest, hardware gate); env.txt",
  "kernel_refs": ["sys/dev/drm/amd/amdgpu/amdgpu_device.c:3414", "sys/dev/drm/amd/amdgpu/amdgpu_device.c:3420", "sys/dev/drm/amd/amdgpu/amdgpu_device.c:3438", "sys/dev/drm/scheduler/sched_main.c:271", "sys/dev/drm/scheduler/sched_main.c:226", "sys/dev/drm/amd/amdgpu/amdgpu_job.c:119"],
  "poc_changes": "authored from scratch (skeleton; CS submission left as documented TODO since no hardware)",
  "attempts": 1,
  "guest_uname": "DragonFly dfbsd 6.5-DEVELOPMENT #0: Thu Jul 2 06:02:54 UTC 2026 root@dfbsd:/usr/obj/usr/src/sys/X86_64_GENERIC x86_64",
  "runtime_sec": 12,
  "guest_dirty": 0,
  "build_cmd": "cc -Wall -O2 -o tdr_race tdr_race.c -lpthread",
  "run_cmd": "./tdr_race",
  "code_hash": "b96d7270c7669f3b8fc55bcdc7ca7feb206a157ad6dc2b5bc512603d075a9ba9",
  "notes": "Race window real but unproven without GPU; filed Medium/speculative. Full fix needs scheduler-side job refcount (upstream did this later); fix.diff removes the post-reset derefs in this file.",
  "recommended_fix": "Snapshot job->base.sched into a local at gpu_recover entry and use it in both loops (fix.diff); longer-term add job refcounting to drm_sched timeout path",
  "fix_status": "not_testable",
  "fix_baseline_reproduced": 0,
  "fix_patched_reproduced": 0,
  "fix_verdict": "fix.diff replaces both job derefs with the snapshot; git apply --check clean; cannot exercise TDR path without AMD hardware",
  "fix_evidence": "findings/poc/DF-3862/fix.diff"
}