# DF-3994 — VERDICT

**Status: inconclusive (source-certain behavior, hardware-gated practical
impact). Low severity — configuration-dependent dispatch corruption, not
user-triggerable.**

## Verified at source level
- The tables are file-scope mutable statics: `static struct radeon_asic
  r420_asic = {...}` (sys/dev/drm/radeon/radeon_asic.c:498) etc., assigned by
  pointer at radeon_asic.c:2357 (`rdev->asic = &r420_asic`).
- Mutation sites write through `rdev->asic->…` into the shared object:
  radeon_asic.c:2360-2364 (r420 macs), 167-175 (radeon_agp_disable), 
  2697-2698 (IGP NULL-out). No per-device copy exists anywhere between
  assignment and mutation (verified by reading `radeon_asic_init()` end to
  end and grepping all `->asic->… =` writes across the driver).
- Consumers of the affected ops: `radeon_pm.c:805/837`-style NULL-guards
  exist for optional ops, but the *values* dispatched (legacy vs atom clock
  accessors) are what get corrupted for the second card; gart op consumers
  call `rdev->asic->gart.*` unconditionally after init
  (e.g. radeon_gart.c via radeon_gart_tlb_flush wrapper).

## Why not reproduced
Needs two same-family radeon cards with asymmetric BIOS/AGP conditions in one
chassis; the audit guest has no radeon hardware at all (DF-3993 `env.txt`).
No userspace trigger exists by construction — the bug fires at probe time.

## Impact ceiling
Hardware-misprogramming on the co-tenant card (wrong PM accessor family /
wrong gart ops) → GPU/system instability. No kernel memory-safety
consequence: the corrupted values are all valid function pointers of the
correct prototype, so this is a correctness/isolation defect, not a
code-execution primitive.

## Fix
Per-device copy of the asic template (kmemdup) before any runtime override —
see README.md fix sketch; keeps `sys/` untouched per audit rules.

## Fix status (batch validation)
Applied with the 36 sibling fix.diffs of this batch in findings/poc/_batch41/all_fixes.patch; single in-guest `make -j6 nativekernel KERNCONF=X86_64_GENERIC` completed RC=0 with zero errors under -Werror (full log: findings/poc/_batch41/fix_build8.log). Behavior A/B intentionally skipped for this Info-tier item.

(No fix.diff for this item: documented recommendation only - see Fix above.)