# VERDICT — DF-3975

**status: inconclusive** (hardware-gated; source-level certainty: likely)

## Trace

```
boot/attach: radeon_pm_init_dpm
  1448  radeon_dpm_init  (btc_dpm_init: eg_pi kzalloc'd, requested_rps.ps_priv == NULL)
  1453  radeon_dpm_enable → btc_dpm_enable succeeds (2485 sets current_rps only)
  1457  dpm_enabled = true
late_init/first compute_clocks:
  radeon_pm_compute_clocks_dpm (radeon_pm.c:1810)
   └─ radeon_dpm_change_power_state_locked (1053)
       1080 current_ps == requested_ps (both = boot_ps, set at radeon_pm.c:1449)
       1105-1107 new_active_crtcs == current_active_crtcs (headless/single-display steady state)
       → return; pre_set_power_state NEVER called → requested_rps.ps_priv stays NULL
first display event (hotplug worker → modeset, or CRTC commit):
  atombios_crtc.c:1448/1642 radeon_bandwidth_update
   └─ evergreen.c:2162 dpm_enabled → radeon_dpm_get_sclk(rdev, false)
       └─ btc_dpm_get_sclk (btc_dpm.c:2802)
           └─ rv770_get_ps(&eg_pi->requested_rps) == NULL
               └─ requested_state->low.sclk → read at 0x0+offset → kernel page fault
```

Exact structural twin of the second half of DF-3953 (kv_dpm_get_sclk ps_priv-NULL window, rated
Medium). DF-3754 (ni) also documents the same window for its file. Not a duplicate: different
asic-op table entry (btcd.h wires btc_dpm_get_sclk for Barts/Turks/Caicos).

Why "likely" and not "certain": the code shape is certain; the runtime window depends on display
event ordering that I could not exercise (no radeon GPU in the guest — env.txt). The early-return
conditions that keep the window open (state==boot state, crtcs unchanged) are ordinary for headless
or single-state-VBIOS systems, and display hotplug is an unprivileged physical action.

## Fix validation

not_testable (no hardware). fix.diff: initialize requested_rps/current_rps from boot_ps at the end of
btc_dpm_enable (mirroring btc_update_current_ps at 2485), which closes the window for every consumer.

## Fix status (batch validation)
Applied with the 36 sibling fix.diffs of this batch in findings/poc/_batch41/all_fixes.patch; single in-guest `make -j6 nativekernel KERNCONF=X86_64_GENERIC` completed RC=0 with zero errors under -Werror (full log: findings/poc/_batch41/fix_build8.log). Behavior A/B intentionally skipped for this Info-tier item.