{
  "finding_id": "DF-4019",
  "status": "untested",
  "attempts": 0,
  "reproduced": 0,
  "confidence": "certain",
  "impact": "debugfs amdgpu_iomem: the upstream page-ownership check is #if 0d (XXX DRAGONFLY - dev_mapping NULL atm), so the file gives its holder arbitrary physical-memory read/write by llseek+read/write (only pfn_valid is checked).",
  "verdict": "source-verified; root-gated via debugfs on a working amdgpu box; defense-in-depth removal vs upstream",
  "exploit_chain": [],
  "evidence": "source-only; path:line citations in pass-2 result block",
  "kernel_refs": [
    "sys/dev/drm/amd/amdgpu/amdgpu_ttm.c:2456",
    "sys/dev/drm/amd/amdgpu/amdgpu_ttm.c:2509"
  ],
  "guest_uname": "",
  "code_hash": "",
  "artifact_dir": "findings/poc/DF-4019/",
  "fix_status": "not_testable",
  "fix_baseline_reproduced": 0,
  "fix_patched_reproduced": 0,
  "fix_verdict": "reinstate an ownership bound before kmap; until then create the file 0400 read-only",
  "fix_evidence": "source-only"
}