{
  "finding_id": "DF-3994",
  "status": "inconclusive",
  "reproduced": 0,
  "impact": "none",
  "confidence": "likely",
  "verdict": "Source-certain state-isolation defect: radeon_asic_init()/radeon_agp_disable() mutate the shared static per-family dispatch tables through rdev->asic (radeon_asic.c:2360-2364, 167-175, 2697-2698), so the first BIOS-less R420-class card (or AGP-disabled RS400) permanently rewrites PM/gart ops for every other card of the same family probed later in the same boot. Consequence is wrong (but type-correct) dispatch on the co-tenant card - legacy-vs-atom clock programming, r100_pci-vs-rs400 gart ops - i.e. hardware misprogramming/instability, not a memory-safety primitive. Not user-triggerable; requires a dual-same-family-GPU machine with asymmetric BIOS/AGP conditions, which the audit guest cannot provide (no radeon hardware). Low severity hardening/correctness finding.",
  "exploit_chain": "",
  "evidence": "README.md (mutation sites + consumers), VERDICT.md (why no memory-safety consequence, why untestable here)",
  "kernel_refs": ["sys/dev/drm/radeon/radeon_asic.c:167", "sys/dev/drm/radeon/radeon_asic.c:2357", "sys/dev/drm/radeon/radeon_asic.c:2360", "sys/dev/drm/radeon/radeon_asic.c:2696"],
  "poc_changes": "n/a (analysis-only; no runnable trigger exists for a probe-time configuration bug)",
  "attempts": 0,
  "guest_uname": "DragonFly dfbsd 6.5-DEVELOPMENT #0: Thu Jul 2 06:02:54 UTC 2026 x86_64",
  "runtime_sec": 0,
  "guest_dirty": 0,
  "build_cmd": "",
  "run_cmd": "",
  "code_hash": "",
  "notes": "Low severity - Phase V PoC skipped per contract (not a program-triggerable condition). Upstream Linux shares this pattern; fix is a per-device kmemdup of the template before mutation.",
  "recommended_fix": "Copy the static asic template into a per-device allocation (kmemdup) in radeon_asic_init() before any runtime override, and free it in device fini",
  "fix_status": "not_testable",
  "fix_baseline_reproduced": 0,
  "fix_patched_reproduced": 0,
  "fix_verdict": "Fix is a per-device kmemdup of the dispatch template (README.md sketch); not testable on a guest with no radeon hardware.",
  "fix_evidence": "findings/poc/DF-3994/README.md#fix-sketch"
}