{
  "finding_id": "DF-4042",
  "status": "inconclusive",
  "reproduced": 0,
  "impact": "none",
  "confidence": "certain",
  "verdict": "Source-certain kernel panic from device-fed message flow: after an unexpected reselection amd_Reselect queues msgout=[MSG_ABORT] (amd.c:1839-1840) and amd_MsgOutPhase1 substitutes [MSG_NOOP] when msgout_len==0 (amd.c:1745-1748); if the target then replies MESSAGE REJECT (any target may legally reject any optional message), amdparsemsg (amd.c:1246) -> amdhandlemsgreject (amd.c:1467) -> amdsentmsg walks msgout_buf and hits the terminal else panic(\"amdsentmsg: Inconsistent msg buffer\") at amd.c:1435 because MSG_ABORT(0x06)/MSG_NOOP(0x08) are not in its recognized set (identify/REJECT/2-byte tag/EXT only). Verified by compiling the verbatim amdsentmsg copy on the guest and driving it with the two real driver states \u2014 both select the panic branch (run.log DF-4042). amd(4) is in the GENERIC kernel (X86_64_GENERIC:88); trigger requires a hostile/compromised SCSI target (or emulation), so runtime reproduction on this guest (no AMD53C974 HBA) is impossible -> inconclusive at runtime, source certain.",
  "exploit_chain": "hostile target: reselect an idle ID (driver queues ABORT) -> send MESSAGE REJECT byte in MSG IN -> amdhandlemsgreject -> amdsentmsg walk -> panic at amd.c:1435 (kernel DoS from interrupt context)",
  "evidence": "run.log section DF-4042 (verbatim-copy walk trace: 0x06 and 0x08 both hit the panic branch; contrast EXT/SDTR case clean); VERDICT.md; fix_build.log; env.txt",
  "kernel_refs": [
    "sys/dev/disk/amd/amd.c:1435",
    "sys/dev/disk/amd/amd.c:1467",
    "sys/dev/disk/amd/amd.c:1839",
    "sys/dev/disk/amd/amd.c:1745",
    "sys/dev/disk/amd/amd.c:1246"
  ],
  "poc_changes": "Pass-2 reviewer authored demonstrator compiling the kernels own headers (smu74.h/smu74_discrete.h packed, or a verbatim copy of the drivers amdsentmsg/parsemsg arms) so struct geometry and branch selection are the kernels; fix.diff generated against the pristine file and compile-validated via full nativekernel rebuild on the guest (shared build with DF-4036..DF-4044, fix_build.log).",
  "attempts": 3,
  "guest_uname": "DragonFly dfbsd 6.5-DEVELOPMENT DragonFly 6.5-DEVELOPMENT #0: Thu Jul  2 06:02:54 UTC 2026 root@dfbsd:/usr/obj/usr/src/sys/X86_64_GENERIC x86_64",
  "runtime_sec": 200,
  "guest_dirty": 0,
  "build_cmd": "./build.sh",
  "run_cmd": "./run.sh",
  "code_hash": "141db72d1d0fefdd08c49b0a88eb9fe244fa09f9e271000acd39d805a6ebdebd",
  "notes": "Hardware-gated (no AMD53c974 HBA on guest; hostile-SCSI-target threat model; amd(4) in GENERIC but never attaches). Kills: msgin_buf walk bounded (max idx 4), tag byte fits SRB_array[256], msgout shift fits, amdtimeout dead code (#if 0), EEPROM walks fit eepromBuf[128].",
  "recommended_fix": "Replace the panic() with a bail-out break (treat as not found) \u2014 the buffer is driver-own, never worth dying over (fix.diff)",
  "fix_status": "fixed",
  "fix_baseline_reproduced": 0,
  "fix_patched_reproduced": 0,
  "fix_kernel_uname": "DragonFly dfbsd 6.5-DEVELOPMENT DragonFly 6.5-DEVELOPMENT #0: Thu Jul  2 06:02:54 UTC 2026 root@dfbsd:/usr/obj/usr/src/sys/X86_64_GENERIC x86_64 (nativekernel X86_64_GENERIC rebuilt with all DF-4036..DF-4044 patches; 0 errors under -Werror; see fix_build.log)",
  "fix_verdict": "fixed (compile-validated): all nine patches applied together to the clean guest /usr/src copy (polaris10_smumgr.c md5 6f39bb32..->19a2b278.., amd.c f577a330..->54ce1518..), make -j4 nativekernel KERNCONF=X86_64_GENERIC completed RC=0 with 0 compile errors under -Werror; the patched polaris10_smumgr.o (amdgpu module) and amd.o (GENERIC kernel) both recompiled. Runtime re-test impossible on this guest (device absent). Sources restored to pristine and md5-verified after validation.",
  "fix_evidence": "findings/poc/DF-4042/fix.diff; findings/poc/DF-4042/fix_build.log (build banner + compile lines + 0 errors)"
}