{
  "finding_id": "DF-3864",
  "status": "not_reproduced",
  "reproduced": 0,
  "impact": "none",
  "confidence": "certain",
  "verdict": "Source-certain NULL dereference on a reachable error path: vm->root.base.bo is published only by amdgpu_vm_bo_base_init (amdgpu_vm.c:3107), but error_unreserve (:3136-3137) already does amdgpu_bo_unreserve(vm->root.base.bo) == unreserve(NULL) -> ttm_bo_unreserve(&NULL->tbo) (amdgpu_object.h:165-168) and error_free_root (:3139-3140) computes &vm->root.base.bo->shadow with base.bo==NULL (small constant address) which amdgpu_bo_unref then loads (amdgpu_object.c:817-825). Reached whenever amdgpu_bo_reserve (:3097) or amdgpu_vm_clear_bo (:3101) fails in amdgpu_vm_init, which runs on EVERY DRM open (amdgpu_kms.c:990); clear_bo draws an IB from the bounded shared pool (amdgpu_ib.c:279-287) and does TTM validation - exhaustible by unprivileged users under load -> unprivileged local kernel panic (DoS, Medium). Upstream v4.20 identical (verified). Guest: no AMD GPU, /dev/dri absent - trigger compiles (RC=0) and reports the gate (run.log): honest not_reproduced.",
  "exploit_chain": "",
  "evidence": "VERDICT.md (ordering proof: create 3093 -> reserve 3097 -> clear_bo 3101 -> base_init 3107 vs labels 3136/3139); build.log/run.log/env.txt",
  "kernel_refs": ["sys/dev/drm/amd/amdgpu/amdgpu_vm.c:3097", "sys/dev/drm/amd/amdgpu/amdgpu_vm.c:3101", "sys/dev/drm/amd/amdgpu/amdgpu_vm.c:3107", "sys/dev/drm/amd/amdgpu/amdgpu_vm.c:3136", "sys/dev/drm/amd/amdgpu/amdgpu_vm.c:3139", "sys/dev/drm/amd/amdgpu/amdgpu_kms.c:990"],
  "poc_changes": "authored from scratch",
  "attempts": 1,
  "guest_uname": "DragonFly dfbsd 6.5-DEVELOPMENT #0: Thu Jul 2 06:02:54 UTC 2026 root@dfbsd:/usr/obj/usr/src/sys/X86_64_GENERIC x86_64",
  "runtime_sec": 11,
  "guest_dirty": 0,
  "build_cmd": "cc -Wall -O2 -o vm_init_error_race vm_init_error_race.c -lpthread",
  "run_cmd": "./vm_init_error_race /dev/dri/renderD128",
  "code_hash": "b844592caeda0c9e7341ee4a92fb5d7e28cca56f98fea7119ba02a48d84685fe",
  "notes": "Panic-class bug; no escalation path (NULL-page kernel trap).",
  "recommended_fix": "Use the local root pointer on both error labels (amdgpu_bo_unreserve(root); amdgpu_bo_unref(&root->shadow); amdgpu_bo_unref(&root)) - fix.diff",
  "fix_status": "not_testable",
  "fix_baseline_reproduced": 0,
  "fix_patched_reproduced": 0,
  "fix_verdict": "fix.diff switches the error labels to the local root pointer which is valid on every path reaching them; git apply --check clean; not exercisable without AMD hardware",
  "fix_evidence": "findings/poc/DF-3864/fix.diff"
}