# DF-4182 — Verification Verdict

**Status:** inconclusive (hardware-gated: no radeon GPU in the QEMU guest; the race needs a real CRTC with vblank interrupts)
**Impact:** none on this guest (permanent per-CRTC page-flip wedge + vblank refcount leak on affected hardware — local DoS)
**Confidence:** likely (state machine provable from source; the race window depends on fence wait timing)

## Mechanism (source trace)

1. `DRM_IOCTL_MODE_PAGE_FLIP` → core takes a vblank reference
   (drm_plane.c:1053 `drm_crtc_vblank_get`) →
   `radeon_crtc_page_flip_target()` (radeon_display.c:474):
   pins the new BO (:524), sets `flip_status = RADEON_FLIP_PENDING`,
   `flip_work = work`, `crtc->primary->fb = fb` (:584-588) and returns 0;
   the actual flip runs later on the crtc workqueue (:592 `queue_work`).
2. User immediately disables the CRTC (SETCRTC with no mode / DPMS off).
3. `radeon_flip_work_func()` (radeon_display.c:402): waits for fences,
   then the wait loop `while (radeon_crtc->enabled && ...)` (:449-458) —
   the `enabled` check only decides whether to *wait for vblank*;
   execution continues regardless.
4. Under the event lock: `radeon_irq_kms_pflip_irq_get()` (:464),
   `radeon_page_flip()` programs the surface base on the **disabled**
   CRTC (:467), and `flip_status = RADEON_FLIP_SUBMITTED` (:469).
5. Completion is detected by `radeon_crtc_handle_vblank()` /
   `radeon_crtc_handle_flip()` (:278/:359) from vblank/pflip interrupts —
   a disabled CRTC generates none, and **nothing else in the driver ever
   resets `flip_status`** (grep across sys/dev/drm/radeon/: only
   radeon_display.c:381 in `radeon_crtc_handle_flip`).
6. Consequences: `radeon_crtc_page_flip_target` rejects every future flip
   with -EBUSY (:578-583); the vblank event never fires
   (`drm_crtc_send_vblank_event` only in the completion path, :386);
   the `drm_crtc_vblank_get` reference from step 1 is never put (the put
   is in the completion path, :390) → vblank irq bookkeeping leaks;
   `work` (with the pinned old_rbo reference) is only freed by the
   unpin_work scheduled from the completion path (:392) → leak.

Reachability: any DRM master (unprivileged desktop session via logind) on
radeon KMS.  The window is the fence wait in step 3 (ms–s under load) —
trivially widened by keeping the GPU busy.  Local DoS of the flip path on
one CRTC until module reload.

## Why it cannot be reproduced on this guest

No ATI/AMD GPU, no /dev/dri; `rflip_wedge` builds and runs,
`open("/dev/dri/card0")` fails ENOENT (run.log).  The race itself requires
a real CRTC with vblank interrupts.

## Fix validation

`fix.diff`: stash `new_rbo` in `struct radeon_flip_work`; in
`radeon_flip_work_func`, when `!radeon_crtc->enabled` at programming
time, reset `flip_status`/`flip_work`, drop the vblank reference, deliver
the event, unpin the new BO and queue the existing unpin work.  Applies
cleanly (radeon.h + radeon_display.c); radeon.ko module built with the
patch (fix_build.log).  Expected behavior on hardware: after disable /
re-enable, PAGE_FLIP succeeds again (step 5 of README).

## Fix status (batch validation)
Applied with the 36 sibling fix.diffs of this batch in findings/poc/_batch41/all_fixes.patch; single in-guest `make -j6 nativekernel KERNCONF=X86_64_GENERIC` completed RC=0 with zero errors under -Werror (full log: findings/poc/_batch41/fix_build8.log). Behavior A/B intentionally skipped for this Info-tier item.