{
  "finding_id": "DF-4314",
  "status": "not_reproduced",
  "reproduced": 0,
  "impact": "none",
  "confidence": "likely",
  "verdict": "Race structurally proven in source but NOT runtime-reproducible on the audit guest: the guest has no Intel GPU (only Bochs/virtio VGA, no /dev/dri, no drm module loaded - see env.txt), so the i915 overlay path cannot execute there; the trigger compiles cleanly on the guest and exits 2 with open() ENOENT. On real Gen2-Gen5 i915 hardware: intel_overlay_reset() (called from i915_reset, which a WAIT_LOCKED overlay waiter even executes inline from its own wait loop) clears overlay->crtc and frees old_vma while a concurrent intel_overlay_off() is still in flight; the pending off_tail retire then executes overlay->crtc->overlay = NULL with crtc==NULL (NULL+offset write -> kernel page fault -> panic), or the resets release_old_vid slowpath trips GEM_BUG_ON (unconditional BUG) in intel_overlay_submit_request because last_flip still tracks the unretired off request. The GPU-reset half is triggerable by an unprivileged client hanging the GPU; the overlay-off half is any Xv stop / CRTC dpms disable. Local DoS panic, Medium.",
  "exploit_chain": "",
  "evidence": "VERDICT.md (full interleaving proof with path:line); trigger.c + build.log + run.log (clean guest compile, honest device-absent run: exit 2, ENOENT); env.txt (guest PCI inventory proving no i915); fix.diff (git apply --check clean; two hunks: NULL-guard off_tail + retire-before-clear in intel_overlay_reset)",
  "kernel_refs": [
    "sys/dev/drm/i915/intel_overlay.c:373",
    "sys/dev/drm/i915/intel_overlay.c:220",
    "sys/dev/drm/i915/intel_overlay.c:364",
    "sys/dev/drm/i915/intel_overlay.c:417",
    "sys/dev/drm/i915/intel_overlay.c:477",
    "sys/dev/drm/i915/intel_overlay.c:488",
    "sys/dev/drm/i915/i915_drv.c:2356",
    "sys/dev/drm/i915/i915_request.c:1258",
    "sys/dev/drm/i915/i915_request.h:712",
    "sys/dev/drm/i915/i915_gem.h:47",
    "sys/dev/drm/i915/intel_display.c:5228"
  ],
  "poc_changes": "Wrote the trigger from scratch (no seed): raw ioctl DRM master + GEM create + GETRESOURCES + PUT_IMAGE on/off hammer using the trees own uapi headers; guest needed -I/usr/src/sys/dev/drm/include and uudecode transfer (no base64 binary on guest).",
  "attempts": 1,
  "guest_uname": "DragonFly dfbsd 6.5-DEVELOPMENT DragonFly 6.5-DEVELOPMENT #0: Thu Jul 2 06:02:54 UTC 2026 root@dfbsd:/usr/obj/usr/src/sys/X86_64_GENERIC x86_64",
  "runtime_sec": 30,
  "guest_dirty": 0,
  "build_cmd": "vm.sh run_root cc -O2 -I/usr/src/sys/dev/drm/include -o /tmp/trigger /tmp/trigger.c",
  "run_cmd": "vm.sh run_root /tmp/trigger /dev/dri/card0",
  "code_hash": "a6499d4a5144fd6e4c159a43f8c8db24cdc3a4afac57f53c36da096aed46c7b4",
  "notes": "Status vocabulary has no not_testable; the true classification is: guest reachable, target device absent (no i915 GPU in QEMU; Bochs/virtio VGA only). The finding itself stands on the source-level race proof in VERDICT.md. Known exclusions DF-1515/DF-1516 (div0, offset overflow) are unrelated and not re-reported. The race window is wide in practice: when the GPU hangs, the masters overlay-off wait blocks until the reset, so overlay-off pending during reset is the common coincidence (video stop + hang), not a narrow window.",
  "recommended_fix": "intel_overlay_reset(): retire the pending last_flip (intel_overlay_recover_from_interrupt) BEFORE clearing overlay state, and NULL-guard overlay->crtc in intel_overlay_off_tail (fix.diff).",
  "fix_status": "not_testable",
  "fix_baseline_reproduced": 0,
  "fix_patched_reproduced": 0,
  "fix_verdict": "fix.diff is git-apply-clean against this tree and kills both crash shapes by ordering (retire off_tail while crtc is valid) plus a NULL guard; cannot be runtime-validated on this guest because the i915 driver cannot attach (no Intel GPU). All three interleavings (reset-inside-waiter, reset-inside-error-handler, deferred retire-worker) re-derived against the patched source: each retires off_tail with crtc valid before any NULL assignment.",
  "fix_evidence": "fix.diff in this pack; git apply --check output captured in run.log lineage (see VERDICT.md Fix validation section)."
}