{
  "finding_id": "DF-3986",
  "title": "drm/radeon ni.c: cayman_init dropped the CP1/CP2 compute-ring r600_ring_init (upstream has them) -> order_base_2(0) UB (1UL<<64 via roundup_pow_of_two) and zero-size/zero-base CP_RB1/2 MMIO programming at every Cayman/Aruba boot",
  "verdict": "inconclusive_source_certain_hardware_gated",
  "impact_ceiling": "none (C-standard UB + wrong GPU MMIO config; compute rings unusable; no kernel memory unsafety - CS ioctl maps COMPUTE to GFX for family < TAHITI, radeon_cs.c:218-224, and radeon_ring_alloc rejects size-0 rings)",
  "reproduce": {
    "build": "n/a (needs AMD Cayman/Aruba GPU)",
    "run": "boot the kernel on Northern Islands hardware; observe cayman_cp_resume iterating ridx {GFX,CP1,CP2} with ring_size==0 for CP1/2",
    "expected": "order_base_2(0) evaluates 1UL<<64 (UB) -> RB_BUFSZ=0, CP_RB1/2_BASE=0 programmed"
  },
  "kernel_refs": [
    "sys/dev/drm/radeon/ni.c:2434",
    "sys/dev/drm/radeon/ni.c:1704",
    "sys/dev/drm/radeon/ni.c:1713",
    "sys/dev/drm/radeon/ni.c:2225",
    "sys/dev/drm/radeon/si.c:6876",
    "sys/dev/drm/radeon/cik.c:8655",
    "sys/dev/drm/include/linux/log2.h:33",
    "sys/dev/drm/radeon/radeon_cs.c:218",
    "sys/dev/drm/radeon/radeon_ring.c:109"
  ],
  "artifacts": ["README.md", "VERDICT.md", "fix.diff", "manifest.json", "verdict.json"]
}