{
  "finding_id": "DF-4196",
  "file": "sys/dev/drm/drm_vblank.c",
  "title": "Lock-free hwmode.crtc_clock=0 store in drm_crtc_vblank_off races the reloaded divisor in drm_calc_vbltimestamp_from_scanoutpos (TOCTOU #DE panic)",
  "verdict": "inconclusive (hardware-gated; defect proven deterministically in model harness)",
  "impact": "dos",
  "confidence": "likely",
  "reproduce": {
    "build": "cc -O2 -Wall -pthread -o vblank_toctou vblank_toctou.c",
    "run": "./vblank_toctou race ; ./vblank_toctou race_fixed",
    "expected": "race: 'Floating point exception' rc=136 (SIGFPE = kernel #DE analog), 3/3 deterministic; race_fixed: 'SURVIVED ... cached-nonzero' rc=0"
  },
  "kernel_refs": ["sys/dev/drm/drm_vblank.c:1169", "sys/dev/drm/drm_vblank.c:618", "sys/dev/drm/drm_vblank.c:671", "sys/dev/drm/drm_ioctl.c:639"],
  "artifacts": ["README.md", "VERDICT.md", "vblank_toctou.c", "build.sh", "run.sh", "build.log", "run.log", "env.txt", "fix.diff", "manifest.json", "verdict.json"]
}