# VERDICT — DF-4215

**status: untested (hardware-gated) · impact: panic (probe-time, OOM-gated) · confidence: certain (source)**

Not reproducible on the audit guest: no AMD GPU (`env.txt` — only bochs
`1234:1111`), so `dc_create()`/`construct()` never execute; the trigger
further requires one of six kzallocs to fail during probe.

Source proof:
- `construct()` order: dceip (569) → vbios (577) → dcn_soc (585) → dcn_ip
  (593) → ctx (602) → current_state (615); every failure `goto fail` →
  `destruct(dc)` (dc.c:686-689).
- `destruct()` line 521: `dc_release_state(dc->current_state)` with
  `current_state == NULL` when 615-620 failed, or when any earlier alloc
  failed (kzalloc'd `dc` still zero) → `kref_put(&context->refcount, …)`
  (dc.c:1103-1106) is an inline read at `NULL+offset` → page fault.
- Even bypassing that, `dc->ctx` may be NULL (602-606 failure) and is
  deref'd at 528/531/534/537.
- ASSERT/ASSERT_CRITICAL are WARN_ON-only (`os_types.h:59-77`) — no
  backstop.

Deterministic NULL-deref, but gated on OOM during GPU probe → Low severity.
Fix is defensive guards; not runtime-validated (no hardware) →
`fix_status: not_testable`.

## Fix status (batch validation)
Applied with the 36 sibling fix.diffs of this batch in findings/poc/_batch41/all_fixes.patch; single in-guest `make -j6 nativekernel KERNCONF=X86_64_GENERIC` completed RC=0 with zero errors under -Werror (full log: findings/poc/_batch41/fix_build8.log). Behavior A/B intentionally skipped for this Info-tier item.