{
  "finding_id": "DF-4340",
  "status": "inconclusive",
  "reproduced": 0,
  "impact": "none",
  "confidence": "certain",
  "verdict": "UB certain, impact low (hardening): ATOM shift counts are untrusted VBIOS values used unmasked at atom.c:937/956 (32-bit operand), 904/920 (byte), 252-255 (WS masks, u8) and in the IIO masks at 125/131/137/147/157 (>> (32-width)). Guest gcc 8.3 -O1 demonstrates the divergence concretely: 0xffff<<40 constant-folds to 0 while the runtime-masked IIO >>32 yields the unmasked value — the GPU-register values the interpreter computes for out-of-range counts are compiler-dependent. No memory-safety consequence; Low/hardening. Kernel runtime hardware-gated (no ATI GPU on guest).",
  "exploit_chain": "",
  "evidence": "run_cases.log [shift] shows folded 0x00000000 vs runtime-masked 0x12345678 divergence for the same UB class",
  "kernel_refs": ["sys/dev/drm/radeon/atom.c:904", "sys/dev/drm/radeon/atom.c:920", "sys/dev/drm/radeon/atom.c:937", "sys/dev/drm/radeon/atom.c:956", "sys/dev/drm/radeon/atom.c:252", "sys/dev/drm/radeon/atom.c:125"],
  "poc_changes": "no seed",
  "attempts": 1,
  "guest_uname": "DragonFly dfbsd 6.5-DEVELOPMENT DragonFly 6.5-DEVELOPMENT #0: Thu Jul  2 06:02:54 UTC 2026     root@dfbsd:/usr/obj/usr/src/sys/X86_64_GENERIC  x86_64",
  "runtime_sec": 30,
  "guest_dirty": 0,
  "build_cmd": "cc -O1 -g -o atom_harness atom_harness.c (on DragonFly guest)",
  "run_cmd": "./atom_harness shift",
  "code_hash": "25677f802601b62268f4d213ef9e2af03250f6c9a544bae5cd4cbfd214ffe6fe",
  "notes": "Low/hardening finding — no kernel runtime PoC required; the guest demo documents the compiler-dependent divergence. Same UB exists in the amdgpu twin.",
  "recommended_fix": "atom_shl/atom_shr helpers with defined semantics (count >= 32 => 0), applied to the shift opcodes, WS masks and IIO masks",
  "fix_status": "inconclusive",
  "fix_baseline_reproduced": 0,
  "fix_patched_reproduced": 0,
  "fix_verdict": "fix.diff git apply --check OK; helpers make out-of-range counts deterministically 0 by construction. Kernel-runtime validation impossible on this guest.",
  "fix_evidence": "fix.diff (helpers + 6 call-site replacements)"
}