{
  "verdict": "inconclusive",
  "impact": "none",
  "reproduce": {
    "build": "cd findings/poc/DF-4366 && ./build.sh   (ships + builds amdgpu_parser_replica.ko on the guest via vm.sh)",
    "run": "cd findings/poc/DF-4366 && ./run.sh        (kldload; sysctl kern.amdgparun=1 -> guest panics into DDB; then vm.sh reset with-src)",
    "expected": "Serial console: 'amdgparun: walking 6-byte content, last byte 0x00' then 'Fatal trap 12: page fault while in kernel mode', 'fault virtual address = 0x0', 'Stopped at run_parse.part.1+0xe0: movzbl (%rax),%edx' (the isspace(*tmp_str) load with tmp_str==NULL after strsep returned NULL on the un-delimited tail). On amdgpu hardware the equivalent is: printf '%s' \"5 1 2 3\" > /sys/class/drm/card0/device/pp_power_profile_mode"
  },
  "kernel_refs": [
    "sys/dev/drm/amd/amdgpu/amdgpu_pm.c:916",
    "sys/dev/drm/amd/amdgpu/amdgpu_pm.c:944",
    "sys/dev/drm/amd/amdgpu/amdgpu_pm.c:948",
    "sys/dev/drm/amd/amdgpu/amdgpu_pm.c:955",
    "sys/libkern/strsep.c:63",
    "sys/sys/ctype.h:43"
  ],
  "artifacts": [
    "README.md",
    "VERDICT.md",
    "amdgpu_parser_replica.c",
    "fix.diff",
    "build.sh",
    "run.sh",
    "build.log",
    "run.log",
    "panic.txt",
    "env.txt",
    "verdict.json",
    "manifest.json"
  ]
}