{
  "finding_id": "DF-3889",
  "status": "inconclusive",
  "reproduced": 0,
  "impact": "none",
  "confidence": "certain",
  "verdict": "Source-certain NULL-pointer dereference (boot_ps family, DF-3586/3623/3646/3754 amdgpu-kv instance); runtime-inconclusive on this guest (no AMD GPU). kv_parse_pplib_non_clock_info (kv_dpm.c:2672-2675) only assigns adev->pm.dpm.boot_ps for an ATOM_PPLIB_CLASSIFICATION_BOOT state and nothing validates one exists; a VBIOS power table without it leaves boot_ps NULL while DPM otherwise inits and enables. On the next suspend or driver detach, kv_dpm_hw_fini/kv_dpm_suspend -> kv_dpm_disable (:1400) calls kv_update_current_ps(adev, NULL) -> kv_get_ps(NULL) (:371-373) reads rps->ps_priv at NULL+40 -> page fault -> panic. sw_init (:3026) and suspend (:3096) also propagate the NULL into current_ps/requested_ps. Harness executes the verbatim NULL+40 deref -> SIGSEGV exit=139 (kernel equivalent: panic).",
  "exploit_chain": "crafted-VBIOS power table without BOOT classification -> dpm_enabled with boot_ps==NULL -> S3 suspend / driver detach -> kv_dpm_disable -> kv_get_ps(NULL) -> kernel page fault -> panic (DoS).",
  "evidence": "run.log: offsetof(struct amdgpu_ps, ps_priv) = 40, kv_dpm_disable (:1400) ... reads *(void**)(NULL + 40); run.2.log: crash mode + Segmentation fault exit=139; VERDICT.md; fix.diff",
  "kernel_refs": [
    "sys/dev/drm/amd/amdgpu/kv_dpm.c:1400",
    "sys/dev/drm/amd/amdgpu/kv_dpm.c:2672",
    "sys/dev/drm/amd/amdgpu/kv_dpm.c:3026",
    "sys/dev/drm/amd/amdgpu/kv_dpm.c:371"
  ],
  "poc_changes": "No seed (pass-2 self-authored); single guest build+run cycle succeeded.",
  "attempts": 2,
  "guest_uname": "DragonFly dfbsd 6.5-DEVELOPMENT #0: Thu Jul  2 06:02:54 UTC 2026 x86_64",
  "runtime_sec": 45,
  "guest_dirty": 0,
  "build_cmd": "cd /tmp/DF-3889 && cc -Wall -O0 -o t h.c",
  "run_cmd": "cd /tmp/DF-3889 && ./t && ./t crash",
  "code_hash": "673063c125c880edc147b15ca3da56f2bdd5b446861490af385afa98acd7938a",
  "notes": "Guest virtio-only (no AMD GPU). Same family/severity as DF-3586 (si_dpm), DF-3623 (ci_dpm), DF-3754 (ni_dpm); not covered by pass-1 DF-1268/1269 on this file. amdgpu_pm.c paths handle the NULL current_ps (check_state_equal :3250) and the verbose print is gated on amdgpu_dpm==1 (default -1), leaving :1400 as the live sink.",
  "recommended_fix": "Fail kv_dpm_init when the parsed power table has no BOOT-classified state, and NULL-guard the kv_update_current_ps call in kv_dpm_disable (:1400).",
  "fix_status": "not_testable",
  "fix_baseline_reproduced": 0,
  "fix_patched_reproduced": 0,
  "fix_verdict": "fix.diff authored against the read-only sys/ tree after source+harness verification; not built (no AMD hardware on guest).",
  "fix_evidence": "findings/poc/DF-3889/fix.diff"
}