{
  "finding_id": "DF-3979",
  "status": "inconclusive",
  "reproduced": 0,
  "impact": "none",
  "confidence": "certain",
  "verdict": "dcn10_enable_per_frame_crtc_position_reset (dcn10_hw_sequencer.c:1406) dereferences triggered_crtc_reset.event_source->status.primary_otg_inst without a NULL check -- the dcn10 twin of DF-3948 (dce110). Dead path in this tree: triggered_crtc_reset.enabled has no producer (amdgpu_dm.c TODO), dc_stream_state is zero-allocated, and enable_timing_multisync (dc.c:794) filters out every pipe before the hwss hook can be reached. Upstream Linux removed the deref by v5.4 (passes 0). No DCN10 GPU on the audit guest and the path is dead by construction, so no runtime demonstration is possible; source certainty only.",
  "exploit_chain": "",
  "evidence": "VERDICT.md: producer grep (no writer of .enabled), dc.c:794 gate, upstream v5.4 comparison.",
  "kernel_refs": [
    "sys/dev/drm/amd/display/dc/dcn10/dcn10_hw_sequencer.c:1406",
    "sys/dev/drm/amd/display/dc/core/dc.c:794",
    "sys/dev/drm/amd/display/amdgpu_dm/amdgpu_dm.c:2831"
  ],
  "poc_changes": "n/a (documentation stub only)",
  "attempts": 0,
  "guest_uname": "DragonFly dfbsd 6.5-DEVELOPMENT #0 600519 x86_64 (no DCN10 GPU)",
  "runtime_sec": 0,
  "guest_dirty": 0,
  "build_cmd": "n/a",
  "run_cmd": "n/a",
  "code_hash": "n/a",
  "notes": "Info severity per the DF-3948 precedent (dead-path latent NULL deref). Hardware-gated in addition.",
  "recommended_fix": "Match upstream v5.4: stop dereferencing event_source in the dcn10 hook (pass 0), or add an explicit NULL guard.",
  "fix_status": "not_applicable",
  "fix_baseline_reproduced": 0,
  "fix_patched_reproduced": 0,
  "fix_verdict": "Info/dead-path finding; no fix validation applicable (no hardware, path unreachable).",
  "fix_evidence": "n/a"
}