{
  "finding_id": "DF-4161",
  "status": "inconclusive",
  "reproduced": 0,
  "impact": "none",
  "confidence": "likely",
  "verdict": "Source-level certain deref chain, runtime hardware-gated (inconclusive per family convention). sysctl_backlight_handler (intel_panel.c:1811-1841) accepts writes from ANY local user (CTLFLAG_RW|CTLFLAG_ANYBODY, registered at :1884-1889) and calls intel_panel_set_backlight(conn_state, val, max) at :1836. intel_panel_set_backlight (:1148-1170) checks ONLY panel->backlight.present (:1156) -- it is missing the !conn_state->crtc guard its ACPI sibling intel_panel_set_backlight_acpi carries at :634 with a comment documenting that crtc-less states occur in practice. With panel->backlight.enabled seeded true from the BIOS handoff (vlv_setup_backlight :1662, enabled = ctl2 & BLM_PWM_ENABLE, independent of any atomic commit) and a connector state carrying no crtc, the dispatch reaches vlv_set_backlight (:577) which executes to_intel_crtc(conn_state->crtc)->pipe at :581 -> container_of(NULL) member read -> page-fault panic. Read side is fully defended (intel_get_pipe_from_connector returns INVALID_PIPE, intel_display.c:14158-14168; _vlv_get_backlight WARN_ONs, :497-503) -- the set-side asymmetry is the oversight. VLV/CHV (non-DSI) only: no other .set hook derefs conn_state->crtc. Guest: virtio VGA only, zero 0x8086 PCI devices, hw.drm/hw.backlight_level unknown oids (env.txt) -> not runtime-testable. Distinct from DF-1411 (modeset-race UAF on the same sysctl) and DF-1412 (bxt VBT controller OOB MMIO); neither re-filed.",
  "exploit_chain": "On VLV/CHV hardware: any local user writes hw.backlight_level (value != current, 0<=val<=max) while the BIOS-lit panels connector state has no crtc -> near-NULL read -> deterministic panic. DoS only; no write primitive, no uid0 route.",
  "evidence": "VERDICT.md (path:line chain + pass-2 negative results); env.txt (hardware absence + md5 cfe495b2207583b24f9c7c5714b38389 == audited tree); trigger.sh (exact unprivileged command); fix.diff (guard + WARN_ON, git apply --check clean)",
  "kernel_refs": [
    "sys/dev/drm/i915/intel_panel.c:1811",
    "sys/dev/drm/i915/intel_panel.c:1836",
    "sys/dev/drm/i915/intel_panel.c:1156",
    "sys/dev/drm/i915/intel_panel.c:634",
    "sys/dev/drm/i915/intel_panel.c:581",
    "sys/dev/drm/i915/intel_panel.c:1662",
    "sys/dev/drm/i915/intel_display.c:14158"
  ],
  "poc_changes": "No seed PoC. trigger.sh authored this pass (documents the unprivileged sysctl command + skip condition for guests).",
  "attempts": 1,
  "guest_uname": "DragonFly dfbsd 6.5-DEVELOPMENT #0: Thu Jul  2 06:02:54 UTC 2026 root@dfbsd:/usr/obj/usr/src/sys/X86_64_GENERIC x86_64",
  "runtime_sec": 15,
  "guest_dirty": 0,
  "build_cmd": "n/a (hardware-gated)",
  "run_cmd": "n/a (hardware-gated; see trigger.sh for on-hardware command)",
  "code_hash": "",
  "notes": "Pass-2 hunt item (f)+(a) for intel_panel.c. Also killed this pass: cnp controller hardcoded 0 (:1719), backlight_device registration dead (#if 0 :1265-1281), all hz_to_pwm div0 guarded (:1446-1453), DSI pwm stub fails closed (linux/pwm.h:68-72 + :34-39), scale() u64/clamp safe (:389-408), masked RMW register writes, sysctl-ctx freed before connector teardown (drm_dragonfly.c:250-256).",
  "recommended_fix": "Mirror the _acpi guard: add if (!conn_state->crtc) return; to intel_panel_set_backlight (+WARN_ON belt-and-braces in vlv_set_backlight), see fix.diff.",
  "fix_status": "not_testable",
  "fix_baseline_reproduced": 0,
  "fix_patched_reproduced": 0,
  "fix_verdict": "fix.diff (guard at :1156 + WARN_ON at vlv_set_backlight) applies clean via git apply --check; cannot be runtime-validated without VLV/CHV hardware.",
  "fix_evidence": "findings/poc/DF-4161/fix.diff"
}