{
  "finding_id": "DF-4313",
  "status": "inconclusive",
  "reproduced": 0,
  "impact": "none",
  "confidence": "likely",
  "verdict": "Two code-certain defects in the dcn10 pool construction error path, neither executable on the audit guest (no AMD GPU; construct() requires amdgpu attach to a Raven-class DCN1 ASIC): (1) dcn10_resource.c:1350 assigns pool->base.pp_smu from dcn10_pp_smu_create() without a NULL check - it is the only unchecked allocation in construct() whose result is dereferenced during construction; with production defaults (disable_pplib_wm_range=false, dcn10_resource.c:536) construct() calls dcn_bw_notify_pplib_of_wm_ranges (dcn10_resource.c:1355-1357) which dereferences pp_smu at dcn_calcs.c:1399/1403 (if (!pp->set_wm_ranges)) with no NULL guard - an allocation failure turns into a kernel NULL-deref panic at GPU probe instead of the graceful fallback all sibling allocations have; (2) dcn10_create_resource_pool (dcn10_resource.c:1493-1496) leaks the several-KB pool allocation when construct() fails, since destruct() frees only the members. Same class as DF-4215 (Low, OOM-gated). fix.diff adds the missing check (goto fail, consistent with the other 15 checks) and kfree(pool) on the failure branch; git apply --check clean; destruct() is NULL-safe for pp_smu (linuxkpi kfree checks NULL, slab.h:39-43).",
  "exploit_chain": "",
  "evidence": "VERDICT.md (line-accurate path enumeration: 1350 -> 1355-1357 -> dcn_calcs.c:1399/1403; leak at 1486/1493), README.md (fail-inject manual test for maintainers), env.txt (guest amd-gpu-count=0), fix.diff",
  "kernel_refs": [
    "sys/dev/drm/amd/display/dc/dcn10/dcn10_resource.c:1350",
    "sys/dev/drm/amd/display/dc/dcn10/dcn10_resource.c:1357",
    "sys/dev/drm/amd/display/dc/calcs/dcn_calcs.c:1399",
    "sys/dev/drm/amd/display/dc/calcs/dcn_calcs.c:1403",
    "sys/dev/drm/amd/display/dc/dcn10/dcn10_resource.c:1493"
  ],
  "poc_changes": "No executable PoC authored: requires DCN1 silicon plus a kzalloc failure inside construct(); the audit guest has no AMD PCI device. Static proof documented instead.",
  "attempts": 1,
  "guest_uname": "DragonFly dfbsd 6.5-DEVELOPMENT DragonFly 6.5-DEVELOPMENT #0: Thu Jul  2 06:02:54 UTC 2026 root@dfbsd:/usr/obj/usr/src/sys/X86_64_GENERIC x86_64",
  "runtime_sec": 60,
  "guest_dirty": 0,
  "build_cmd": "",
  "run_cmd": "",
  "code_hash": "",
  "notes": "Checklist sweep of the rest of the error paths was negative: destruct()s in-loop irqs destroy is safe (dal_irq_service_destroy NULLs, irq_service.c:65-73), the duplicated stream_enc kfree is kfree(NULL)-safe, all pipe/ddc/audio/clk_src loops are bounded by res_cap/pipe_count/clk_src_count against 4..7-entry arrays for both DCN1_0 and DCN1_01 (both defined in sys/dev/drm/kconfig.h:24-25).",
  "recommended_fix": "NULL-check dcn10_pp_smu_create() (goto fail) and kfree(pool) when construct() fails in dcn10_create_resource_pool (see fix.diff).",
  "fix_status": "not_applicable",
  "fix_baseline_reproduced": 0,
  "fix_patched_reproduced": 0,
  "fix_verdict": "not_applicable: no DCN1 hardware available for a live baseline/patched run; fix verified by inspection against destruct()s NULL-safe teardown and by git apply --check.",
  "fix_evidence": "findings/poc/DF-4313/fix.diff"
}