{
  "finding_id": "DF-3973",
  "status": "inconclusive",
  "reproduced": 0,
  "impact": "none",
  "confidence": "likely",
  "verdict": "btc_dpm_inits failure is ignored by radeon_pm_init_dpm (radeon_pm.c:1448); two error paths then leave dangling pointers that btc_dpm_fini frees a second time: (1) rv7xx_parse_power_tables per-state kzalloc failure kfrees rdev->pm.dpm.ps without NULLing (rv770_dpm.c:2308) while radeon_dpm_enable may still read through boot_ps into the freed array, and btc_dpm_fini (btc_dpm.c:2724) kfrees it again; (2) the vddc_dependency_on_dispclk alloc-failure path (btc_dpm.c:2584) calls r600_free_extended_power_table, whose 13 un-NULLed pointers (r600_dpm.c:1303-1314) are freed a second time at teardown (btc_dpm.c:2727). eg_pi and already-parsed ps_priv objects also leak on every early error return. Hardware-gated (no radeon GPU in the guest), alloc-failure-window gated (AC:H): same class/rating family as DF-3755/DF-3645.",
  "exploit_chain": "",
  "evidence": "VERDICT.md (two double-free traces + leak inventory); fix.diff (NULL-after-free + error propagation)",
  "kernel_refs": [
    "sys/dev/drm/radeon/btc_dpm.c:2574",
    "sys/dev/drm/radeon/btc_dpm.c:2584",
    "sys/dev/drm/radeon/btc_dpm.c:2721",
    "sys/dev/drm/radeon/btc_dpm.c:2724",
    "sys/dev/drm/radeon/btc_dpm.c:2727",
    "sys/dev/drm/radeon/rv770_dpm.c:2308",
    "sys/dev/drm/radeon/r600_dpm.c:1303",
    "sys/dev/drm/radeon/radeon_pm.c:1448",
    "sys/dev/drm/radeon/radeon_pm.c:1705"
  ],
  "poc_changes": "No PoC: hardware-gated + requires timed kzalloc failure during attach (heap-pressure window).",
  "attempts": 1,
  "guest_uname": "DragonFly dfbsd 6.5-DEVELOPMENT #0: Thu Jul  2 06:02:54 UTC 2026 root@dfbsd:/usr/obj/usr/src/sys/X86_64_GENERIC x86_64",
  "runtime_sec": 15,
  "guest_dirty": 0,
  "build_cmd": "",
  "run_cmd": "",
  "code_hash": "",
  "notes": "Checklist item (b) for btc_dpm.c. The rv770_dpm.c kfree site is shared with rv770/rv740/cypress-era asics, but the BTC consumption (ignored init error + btc_dpm_fini second free + r600_free_extended_power_table re-free) is btc_dpm.c-specific; DF-1333/1334/1335 (rv770_dpm.c pass-1) do not cover it.",
  "recommended_fix": "NULL every freed pointer in r600_free_extended_power_table and in rv7xx_parse_power_tables error path; honor radeon_dpm_inits return in radeon_pm_init_dpm.",
  "fix_status": "not_testable",
  "fix_baseline_reproduced": null,
  "fix_patched_reproduced": null,
  "fix_verdict": "fix.diff authored (NULL-after-free at both sites + error propagation); not build-testable without a Barts-class GPU.",
  "fix_evidence": "findings/poc/DF-3973/fix.diff"
}