{
  "finding_id": "DF-3864",
  "title": "amdgpu_vm_init error paths dereference vm->root.base.bo before amdgpu_vm_bo_base_init assigns it (NULL deref -> panic, unprivileged DoS)",
  "verdict": "not_reproduced",
  "reproduce": {
    "build": "cc -Wall -O2 -o vm_init_error_race vm_init_error_race.c -lpthread (builds on guest, RC=0)",
    "run": "./vm_init_error_race /dev/dri/renderD128 (needs AMD hw + IB-pool/memory pressure)",
    "expected": "amdgpu_vm_clear_bo failure at open -> error_unreserve -> amdgpu_bo_unreserve(NULL) (amdgpu_object.h:165 -> ttm_bo_unreserve(&NULL->tbo)) -> kernel panic; reserve failure -> error_free_root -> amdgpu_bo_unref(&NULL->shadow) -> low-address load -> panic"
  },
  "kernel_refs": ["sys/dev/drm/amd/amdgpu/amdgpu_vm.c:3097", "sys/dev/drm/amd/amdgpu/amdgpu_vm.c:3101", "sys/dev/drm/amd/amdgpu/amdgpu_vm.c:3107", "sys/dev/drm/amd/amdgpu/amdgpu_vm.c:3136", "sys/dev/drm/amd/amdgpu/amdgpu_vm.c:3139", "sys/dev/drm/amd/amdgpu/amdgpu_object.h:165", "sys/dev/drm/amd/amdgpu/amdgpu_kms.c:990", "sys/dev/drm/amd/amdgpu/amdgpu_ib.c:279"],
  "artifacts": ["README.md", "VERDICT.md", "vm_init_error_race.c", "build.sh", "run.sh", "build.log", "run.log", "env.txt", "fix.diff", "manifest.json", "verdict.json"]
}