{
  "finding_id": "DF-3976",
  "status": "inconclusive",
  "reproduced": 0,
  "impact": "none",
  "confidence": "certain",
  "verdict": "btc_dpm_init:2602-2607 uses the ATOM-computed ref_div only on the FAILURE arm of radeon_atom_get_clock_dividers and the hardcoded default on success — the condition is inverted relative to the ni_dpm.c:2015-2020 pattern. No uninit read (callee memsets dividers, radeon_atombios.c:2838); impact is a wrong pi->ref_div (1 on failure) feeding MPLL lock-time programming (rv770_dpm.c:815) — hardware-stability only. Info severity per DF-3652 precedent for inverted returns. Hardware-gated: not runtime-testable in the guest.",
  "exploit_chain": "",
  "evidence": "README.md code excerpt; ni_dpm.c:2015-2020 shows the correct pattern",
  "kernel_refs": ["sys/dev/drm/radeon/btc_dpm.c:2602", "sys/dev/drm/radeon/radeon_atombios.c:2838", "sys/dev/drm/radeon/rv770_dpm.c:815"],
  "poc_changes": "No PoC (Info-severity logic inversion; nothing to reproduce without hardware).",
  "attempts": 1,
  "guest_uname": "DragonFly dfbsd 6.5-DEVELOPMENT #0: Thu Jul  2 06:02:54 UTC 2026 root@dfbsd:/usr/obj/usr/src/sys/X86_64_GENERIC x86_64",
  "runtime_sec": 5,
  "guest_dirty": 0,
  "build_cmd": "",
  "run_cmd": "",
  "code_hash": "",
  "notes": "Hardening/correctness finding; skipped PoC per contract for Info findings — status recorded as inconclusive (hardware-gated) rather than skipped to satisfy the poc status vocabulary.",
  "recommended_fix": "Invert the condition: use dividers.ref_div + 1 on success (!ret), default on failure.",
  "fix_status": "not_testable",
  "fix_baseline_reproduced": null,
  "fix_patched_reproduced": null,
  "fix_verdict": "fix.diff authored (condition flip); not runtime-testable without hardware.",
  "fix_evidence": "findings/poc/DF-3976/fix.diff"
}