{
  "finding_id": "DF-3980",
  "status": "inconclusive",
  "reproduced": 0,
  "impact": "none",
  "confidence": "certain",
  "verdict": "hwss1_plane_atomic_disconnect dereferences stream_res.opp at dcn10_hw_sequencer.c:889 and only tests it for NULL afterwards at :897, so the guard is dead. Both current callers guarantee non-NULL (dcn10_init_hw assigns opp at :1076 before the :1078 call; dcn10_apply_ctx_for_surface only reaches the hook for old planes with mapped OPP resources at :2387-2391), and Linux v5.4 carries the identical misplaced check, so this is a latent carried-in defect rather than a port regression. No DCN10 GPU on the audit guest and no reachable trigger by construction: no runtime demonstration possible; Info hardening with a one-line fix (hoist the NULL check).",
  "exploit_chain": "",
  "evidence": "VERDICT.md: caller-by-caller safety proof + upstream v5.4 byte-identical comparison.",
  "kernel_refs": [
    "sys/dev/drm/amd/display/dc/dcn10/dcn10_hw_sequencer.c:889",
    "sys/dev/drm/amd/display/dc/dcn10/dcn10_hw_sequencer.c:897"
  ],
  "poc_changes": "n/a (documentation stub only)",
  "attempts": 0,
  "guest_uname": "DragonFly dfbsd 6.5-DEVELOPMENT #0 600519 x86_64 (no DCN10 GPU)",
  "runtime_sec": 0,
  "guest_dirty": 0,
  "build_cmd": "n/a",
  "run_cmd": "n/a",
  "code_hash": "n/a",
  "notes": "Info severity: latent NULL-deref, unreachable today, upstream-identical.",
  "recommended_fix": "Hoist `if (opp == NULL) return;` to the top of hwss1_plane_atomic_disconnect (pattern already used by dcn10_wait_for_mpcc_disconnect :2579).",
  "fix_status": "not_applicable",
  "fix_baseline_reproduced": 0,
  "fix_patched_reproduced": 0,
  "fix_verdict": "Info hardening finding; no fix validation applicable (no hardware, unreachable path).",
  "fix_evidence": "n/a"
}