{
  "finding_id": "DF-3953",
  "title": "boot_ps NULL dereference panic in kv_dpm_enable/kv_dpm_disable (radeon kv_dpm) when VBIOS power table has no BOOT-classified state",
  "file": "sys/dev/drm/radeon/kv_dpm.c",
  "severity": "Medium",
  "status": "inconclusive",
  "impact_class": "panic (hardware+VBIOS-gated DoS)",
  "verdict": {
    "reproduced": false,
    "confidence": "certain (source), runtime-inconclusive on this guest",
    "summary": "kv_update_current_ps(rdev, NULL) at kv_dpm.c:1277/:1326 dereferences rps->ps_priv at NULL+64; kv_dpm_get_sclk kv_dpm.c:2881 faults through ps_priv==NULL after pick_power_state returns NULL (radeon_pm.c:1051). radeon_pm.c:1448 discards kv_dpm_init()'s error, so nothing gates the enable path.",
    "harness_result": "child1 (kv_get_ps(NULL) via :1277): SIGSEGV; child2 (kv_dpm_get_sclk :2881): SIGSEGV; rc=0"
  },
  "kernel_refs": [
    "sys/dev/drm/radeon/kv_dpm.c:1277",
    "sys/dev/drm/radeon/kv_dpm.c:1326",
    "sys/dev/drm/radeon/kv_dpm.c:239",
    "sys/dev/drm/radeon/kv_dpm.c:2881",
    "sys/dev/drm/radeon/kv_dpm.c:2598",
    "sys/dev/drm/radeon/radeon_pm.c:1448",
    "sys/dev/drm/radeon/radeon_pm.c:1051",
    "sys/dev/drm/radeon/cik.c:9287"
  ],
  "reproduce": {
    "build": "cd findings/poc/DF-3953 && ./build.sh",
    "run": "cd findings/poc/DF-3953 && ./run.sh",
    "expected": "analysis mode exits 0 printing offsetof(ps_priv)=64 and the call chain; crash mode: both children SIGSEGV sig=11, final line 'RESULT: BOTH SINKS FAULT AS PREDICTED (rc=0)'"
  },
  "artifacts": [
    "README.md", "VERDICT.md", "trigger_df3953.c", "build.sh", "run.sh",
    "build.log", "run.log", "env.txt", "fix.diff", "manifest.json", "verdict.json"
  ]
}