{
  "finding_id": "DF-4272",
  "status": "untested",
  "reproduced": 0,
  "impact": "none",
  "confidence": "likely",
  "verdict": "Source-certain NULL-deref path, OOM-gated trigger. dcn_bw_notify_pplib_of_wm_ranges() (dcn_calcs.c:1401) loads pp = dc->res_pool->pp_smu and dereferences pp->set_wm_ranges at :1406 without checking pp. The sole assignment is pool->base.pp_smu = dcn10_pp_smu_create(ctx) (dcn10_resource.c:1352), which returns NULL on kzalloc failure (dcn10_resource.c:858-865); no NULL check anywhere between create and use. Call sites: dcn10_resource.c:1353-1357 (probe, unconditional unless disable_pplib_wm_range) and dcn10_hw_sequencer.c:2303 (optimize_shared_resources). Allocation failure during amdgpu DCN1 probe -> NULL read -> panic at boot/probe on Raven APU systems. Guest has no DCN1 GPU (env.txt), so not kernel-reproduced; trigger requires kernel memory pressure at the wrong instant (speculative trigger, certain code path). Upstream Linux DC of this vintage carries the same latent pattern.",
  "exploit_chain": "",
  "evidence": "VERDICT.md trace (create->store->deref chain with path:line); dcn10_resource.c:858-865 (NULL return), :1352-1357 (unchecked store + probe-time call); dcn_calcs.c:1401-1406",
  "kernel_refs": [
    "sys/dev/drm/amd/display/dc/calcs/dcn_calcs.c:1401",
    "sys/dev/drm/amd/display/dc/calcs/dcn_calcs.c:1406",
    "sys/dev/drm/amd/display/dc/dcn10/dcn10_resource.c:1352",
    "sys/dev/drm/amd/display/dc/dcn10/dcn10_resource.c:1357",
    "sys/dev/drm/amd/display/dc/dcn10/dcn10_resource.c:858",
    "sys/dev/drm/amd/display/dc/dcn10/dcn10_resource.c:865",
    "sys/dev/drm/amd/display/dc/dcn10/dcn10_hw_sequencer.c:2303"
  ],
  "poc_changes": "No PoC (no DCN1 hardware in guest); analysis pack.",
  "attempts": 0,
  "guest_uname": "DragonFly dfbsd 6.5-DEVELOPMENT DragonFly 6.5-DEVELOPMENT #0: Thu Jul  2 02:54:00 UTC 2026  root@dfbsd:/usr/obj/usr/src/sys/X86_64_GENERIC x86_64",
  "runtime_sec": 0,
  "guest_dirty": 0,
  "build_cmd": "",
  "run_cmd": "",
  "code_hash": "",
  "notes": "Part of the dcn_calcs.c pass-2 audit (DF-1485/DF-1486 known and excluded). Checklist item (b)/(c) sweep of the dml1 call surface; this is the only new actionable defect found in the file - division sites, per-plane array bounds, per-state tables, config copies and log/pow usage were all traced and found safe (see task_log negative notes).",
  "recommended_fix": "if (!pp || !pp->set_wm_ranges) return; in dcn_bw_notify_pplib_of_wm_ranges().",
  "fix_status": "not_testable",
  "fix_baseline_reproduced": 0,
  "fix_patched_reproduced": 0,
  "fix_verdict": "Fix validation requires DCN1 hardware; the guest has none.",
  "fix_evidence": "fix.diff; VERDICT.md"
}