{
  "finding_id": "DF-4022",
  "status": "inconclusive",
  "reproduced": 0,
  "impact": "none",
  "confidence": "certain",
  "verdict": "Source-level certain, runtime hardware-gated (inconclusive per family convention). rv7xx_parse_power_table (rv770_dpm.c:2271-2329) only sets rdev->pm.dpm.boot_ps inside rv7xx_parse_pplib_non_clock_info (:2172-2173), which is reached only when ucStateEntrySize>1 (:2304) and only for a state carrying ATOM_PPLIB_CLASSIFICATION_BOOT; a crafted VBIOS with no such state (or ucStateEntrySize<=1, which also leaves ps_priv[i] NULL) leaves boot_ps NULL while num_ps is still published (:2327). radeon_pm_init_dpm IGNORES the dpm.init return (radeon_pm.c:1448) -- so rv770_dpm_init failures (r600_get_platform_caps :2364, parse :2368) reach the same state -- then publishes NULL (radeon_pm.c:1449) and calls radeon_dpm_enable (radeon_pm.c:1453) = rv770_dpm_enable (rv770_dpm.c:1898) which never checks boot_ps (:1901) and passes NULL to rv770_init_smc_table (:1956) where rv770_get_ps(NULL) reads NULL->ps_priv (:52-57 via :1170) and boot_state->low.sclk (:1176) -> page-fault panic at drm attach on RV770/RV730/RV710/RV740 (rv770_asic dispatch, radeon_asic.c:1216/1285). Same sinks re-hit on every rv770_dpm_get_sclk/get_mclk via requested_ps (rv770_dpm.c:2554-2572) and the resume path (radeon_pm.c:1320). Guest: virtio VGA only, zero 0x1002 PCI devices, hw.drm absent (env.txt) -> not runtime-testable; rv770-family twin of DF-3972/3953/3754/3646/3610, NOT previously filed against this file (pass 1 filed DF-1333/1334/1335 only).",
  "exploit_chain": "On RV770-family hardware: craft/reflash VBIOS PowerPlayInfo (PCIe passthrough/hotplug) with no BOOT-classified state -> drm attach panics -> reboot-loop DoS. No write primitive; NULL-deref only.",
  "evidence": "VERDICT.md (path:line chain); env.txt (hardware absence + guest-src md5 044c898d346408165b2f18b045f210c9 == audited tree); fix.diff (boot-state guard + init-error propagation, git apply --check clean)",
  "kernel_refs": [
    "sys/dev/drm/radeon/rv770_dpm.c:2271",
    "sys/dev/drm/radeon/rv770_dpm.c:2304",
    "sys/dev/drm/radeon/rv770_dpm.c:2172",
    "sys/dev/drm/radeon/rv770_dpm.c:2327",
    "sys/dev/drm/radeon/rv770_dpm.c:2368",
    "sys/dev/drm/radeon/rv770_dpm.c:1898",
    "sys/dev/drm/radeon/rv770_dpm.c:1901",
    "sys/dev/drm/radeon/rv770_dpm.c:1956",
    "sys/dev/drm/radeon/rv770_dpm.c:1170",
    "sys/dev/drm/radeon/rv770_dpm.c:1176",
    "sys/dev/drm/radeon/radeon_pm.c:1448",
    "sys/dev/drm/radeon/radeon_pm.c:1453",
    "sys/dev/drm/radeon/radeon_asic.c:1285"
  ],
  "poc_changes": "No seed PoC. No runnable PoC possible on this guest (no radeon hardware); pack follows the DF-3972 convention (env + VERDICT + fix).",
  "attempts": 1,
  "guest_uname": "DragonFly dfbsd 6.5-DEVELOPMENT #0: Thu Jul  2 06:02:54 UTC 2026 root@dfbsd:/usr/obj/usr/src/sys/X86_64_GENERIC x86_64",
  "runtime_sec": 15,
  "guest_dirty": 0,
  "build_cmd": "n/a (hardware-gated)",
  "run_cmd": "n/a (hardware-gated)",
  "code_hash": "",
  "notes": "Pass-2 checklist item (a) for rv770_dpm.c. The DF-3972 btc twins root cause (boot_ps only set under ucStateEntrySize>1 + BOOT classification) lives HERE in the shared parser, and the rv770-family consumption (rv770_dpm_enable/rv770_init_smc_table + ignored radeon_pm.c:1448) was unfiled. Also killed this pass: SMC copy loops bounded (rv770_smc.c:304-307 int-promoted u16 check), eg_pi alias in rv7xx_parse_pplib_clock_info:2183 is family-guarded (:2231/:2240), uvd_ps/ulv.pl alias into ps[] are never dereferenced post-fini, div0 at :341/:523 via unvalidated reference_freq (radeon_atombios.c:1146-1220) is DF-1334s family (not re-filed), inverted dividers-ret check at :2377-2382 is logic-only (dividers memset in callee, radeon_atombios.c:2838).",
  "recommended_fix": "Guard rv770_dpm_enable against NULL boot_ps/ps_priv and stop ignoring dpm.init failure in radeon_pm_init_dpm (see fix.diff).",
  "fix_status": "not_testable",
  "fix_baseline_reproduced": 0,
  "fix_patched_reproduced": 0,
  "fix_verdict": "fix.diff (rv770_dpm.c guard + radeon_pm.c error propagation) applies clean against the read-only tree; cannot be runtime-validated on a guest without radeon hardware.",
  "fix_evidence": "findings/poc/DF-4022/fix.diff"
}