{
 "finding_id": "DF-4018",
 "status": "untested",
 "attempts": 0,
 "reproduced": 0,
 "confidence": "certain",
 "impact": "amdgpu userptr machinery is dead-but-armed: usertask never set (#if 0) so re-enabling GEM_USERPTR instantly NULL-derefs at amdgpu_ttm.c:834 (guard after deref); gup shim has an inverted KKASSERT; pin failure path kfrees ttm->sg without NULLing (double-free shape); bind-error paths leak pinned pages.",
 "verdict": "source-verified; dead as shipped (ioctl returns EINVAL); landmine one untested re-enablement away",
 "exploit_chain": [],
 "evidence": "source-only; path:line citations in pass-2 result block",
 "kernel_refs": [
  "sys/dev/drm/amd/amdgpu/amdgpu_ttm.c:834",
  "sys/dev/drm/amd/amdgpu/amdgpu_ttm.c:1363",
  "sys/dev/drm/amd/amdgpu/amdgpu_gem.c:285"
 ],
 "guest_uname": "",
 "code_hash": "",
 "artifact_dir": "findings/poc/DF-4018/",
 "fix_status": "not_testable",
 "fix_baseline_reproduced": 0,
 "fix_patched_reproduced": 0,
 "fix_verdict": "finish the port (set usertask with get_task_struct, fix the shim assert, NULL ttm->sg after kfree, symmetric cleanup) or delete the dead backend",
 "fix_evidence": "source-only"
}