DF-4265 evidence pack — verdict
===============================

Reproduced?  NOT at runtime — hardware-gated (no AMD GPU on the audit
guest).  Defect certain at code level; realistic manifestation is a
narrow race (RCU-deferred free), hence confidence=likely for end-to-end
impact.

Proof chain
-----------
1. `amdgpu_cs_wait_fences_ioctl()` (amdgpu_cs.c:1590-1622) with
   `wait_all=1` reaches `amdgpu_cs_wait_all_fences()` (:1481-1516).
2. `fence = amdgpu_cs_get_fence(...)` (:1494) returns a referenced
   fence: `amdgpu_ctx_get_fence()` does
   `dma_fence_get(centity->fences[seq & (amdgpu_sched_jobs-1)])`
   (amdgpu_ctx.c:489) — our own reference on top of the context array's.
3. Body of the loop (:1500-1509):
       r = dma_fence_wait_timeout(fence, true, timeout);
       dma_fence_put(fence);          /* :1501 */
       ...
       if (fence->error)              /* :1508 — read AFTER put */
               return fence->error;
4. The context array reference is dropped when the slot is overwritten by
   a later submission: `amdgpu_ctx_add_fence()` (amdgpu_ctx.c:440-464)
   replaces `centity->fences[seq & 31]` and `dma_fence_put(other)`
   (:461).  After 32 further submissions on the entity (plus normal
   scheduler teardown of the finished job), the reference dropped at
   :1501 can be the final one.
5. Free path on this tree: `dma_fence_put` → kref → 
   `drm_sched_fence_release_finished` (sched_fence.c:122-127) → put of
   the embedded `scheduled` fence → `drm_sched_fence_release_scheduled`
   (sched_fence.c:107-113) → `call_rcu(..., drm_sched_fence_free)` —
   the slab object is returned to `sched_fence_slab` only after an RCU
   grace period.  Between :1501 and :1508 there are no RCU
   read-side critical sections holding it, so the read is a genuine
   use-after-free in the C sense; practical manifestation requires the
   grace period to elapse inside the window (preemption + idle machine
   makes this possible but rare).  If freed+reallocated (attacker
   submits jobs concurrently — `drm_sched_fence_create` allocates from
   the same slab), :1508 reads the NEW object's `error` field and
   returns it as the ioctl's errno → 4-byte heap oracle.  If freed and
   not reused, the read touches slab memory (typically non-fatal).
6. The correct ordering exists in the sibling ioctl
   `amdgpu_cs_wait_ioctl()` (:1367-1371: error read precedes the put) —
   this is a local defect of wait_all_fences only.

Guest verification performed
----------------------------
- trigger compiles (build.log); runs to the hardware gate (run.log)
- baseline + patched (reordered put) in-tree compile rc=0 with -Werror
  (kmod_baseline_build.log / fix_build.log; fix hunk at :1498+)

Exploit chain: read-only oracle; no write primitive; no escalation path.

Recommended fix: read `fence->error` before `dma_fence_put(fence)`,
covering all exit paths (fix.diff).

## Fix status (batch validation)
Applied with the 36 sibling fix.diffs of this batch in findings/poc/_batch41/all_fixes.patch; single in-guest `make -j6 nativekernel KERNCONF=X86_64_GENERIC` completed RC=0 with zero errors under -Werror (full log: findings/poc/_batch41/fix_build8.log). Behavior A/B intentionally skipped for this Info-tier item.