{
  "finding_id": "DF-4265",
  "status": "untested",
  "reproduced": 0,
  "impact": "none",
  "confidence": "likely",
  "verdict": "Genuine use-after-free READ ordering defect in amdgpu_cs_wait_all_fences(): dma_fence_put(fence) at amdgpu_cs.c:1501 precedes the fence->error read at :1508; when our reference is the last one (context slot replaced after 32 further submissions - amdgpu_ctx.c:449-461 - and scheduler refs dropped) the read touches freed memory. On this tree the free is RCU-deferred (sched_fence.c:107-113 call_rcu), so single-threaded manifestation is unlikely and the practical ceiling is a 4-byte heap oracle returned as the ioctl errno (plus theoretical crash) - hence Low severity / confidence likely for end-to-end impact while the code defect itself is certain (the sibling amdgpu_cs_wait_ioctl at :1367-1370 has the correct order). Runtime reproduction hardware-gated (no AMD GPU on guest); fix (reordered put covering all exit paths) compiles in-tree with -Werror.",
  "exploit_chain": "Read-only oracle on drm_sched_fence slab reuse; no write primitive.",
  "evidence": "wait_all_fences_uaf.c (33 GFX submissions then WAIT_FENCES all on seq 1); run.log (hardware gate); kmod_baseline_build.log + fix_build.log; VERDICT.md has the full refcount/rcu analysis.",
  "kernel_refs": [
    "sys/dev/drm/amd/amdgpu/amdgpu_cs.c:1501",
    "sys/dev/drm/amd/amdgpu/amdgpu_cs.c:1508",
    "sys/dev/drm/amd/amdgpu/amdgpu_cs.c:1367",
    "sys/dev/drm/amd/amdgpu/amdgpu_ctx.c:449",
    "sys/dev/drm/amd/amdgpu/amdgpu_ctx.c:461",
    "sys/dev/drm/amd/amdgpu/amdgpu_ctx.c:489",
    "sys/dev/drm/scheduler/sched_fence.c:107"
  ],
  "poc_changes": "Trigger written from scratch; SCHED_JOBS=32 matches amdgpu_sched_jobs default (amdgpu_drv.c:108) so the slot holding seq 1 is recycled by the 33rd submission.",
  "attempts": 1,
  "guest_uname": "DragonFly dfbsd 6.5-DEVELOPMENT DragonFly 6.5-DEVELOPMENT #0: Thu Jul  2 06:02:54 UTC 2026  root@dfbsd:/usr/obj/usr/src/sys/X86_64_GENERIC x86_64",
  "runtime_sec": 90,
  "guest_dirty": 0,
  "build_cmd": "cc -O2 -Wall -o wait_all_fences_uaf wait_all_fences_uaf.c",
  "run_cmd": "./wait_all_fences_uaf",
  "code_hash": "c9776ced2c947da5807746d86af1cd5f0a72c89aff043cbf7ef7f0811b5f85d7",
  "notes": "poc status untested = runtime verification blocked by absent AMD GPU. Guest reset with-src before return.",
  "recommended_fix": "Read fence->error before dma_fence_put() and put the reference on every exit path (r<0, r==0 break, error return, loop continue).",
  "fix_status": "not_testable",
  "fix_baseline_reproduced": 0,
  "fix_patched_reproduced": 0,
  "fix_verdict": "Reordering fix.diff applied on the guest stacked with the other amdgpu_cs.c fixes (hunk @1498) and compiled in-tree with -Werror rc=0 (fix_build.log). Runtime comparison impossible (no AMD GPU); compile-only validation.",
  "fix_evidence": "fix_build.log rc=0; guest patch output Hunk #1 succeeded at 1498 (offset -15 lines)."
}