{
  "finding_id": "DF-4448",
  "status": "untested",
  "reproduced": 0,
  "impact": "none",
  "confidence": "certain",
  "verdict": "In dce120 construct() with harvesting enabled (Vega20), ipps and transforms are allocated into slot [j] but NULL-checked at slot [i]; after a fused pipe is skipped (j<i) the check reads a never-written kzalloc slot, always NULL, so construct() spuriously fails and the whole DCE12 pool (and amdgpu_dm display init) dies at probe on any Vega20 with fused display pipes. Missed-NULL direction proved impossible (slot [i] cannot be non-NULL when j<i at check time), unwind is clean (all destruct paths NULL-guarded, dal_irq_service_destroy NULLs). Distinct from DF-1628 (opps missing goto). Upstream v6.6 still carries the same mismatch.",
  "exploit_chain": "",
  "evidence": "findings/poc/DF-4448/VERDICT.md (i/j invariant proof); dce120_resource.c:1049-1055 and :1057-1063 vs allocations at [j]; j++ at :1075; kzalloc pool at :1131",
  "kernel_refs": [
    "sys/dev/drm/amd/display/dc/dce120/dce120_resource.c:1049",
    "sys/dev/drm/amd/display/dc/dce120/dce120_resource.c:1057",
    "sys/dev/drm/amd/display/dc/dce120/dce120_resource.c:1022"
  ],
  "poc_changes": "n/a",
  "attempts": 0,
  "guest_uname": "DragonFly dfbsd 6.5-DEVELOPMENT #0 Thu Jul 2 2026 x86_64 (guest has no AMD GPU)",
  "runtime_sec": 0,
  "guest_dirty": 0,
  "build_cmd": "",
  "run_cmd": "",
  "code_hash": "",
  "notes": "Low severity: hardware-conditional (Vega20 + fused pipes), boot-time functional DoS of display init, no memory unsafety (spurious-failure only; proved). Not attacker-triggerable. PoC skipped per contract for Low findings — hardware absent on guest in any case.",
  "recommended_fix": "NULL-check the slot that was allocated: ipps[j] and transforms[j] (fix.diff, 2-line change).",
  "fix_status": "not_testable",
  "fix_baseline_reproduced": 0,
  "fix_patched_reproduced": 0,
  "fix_verdict": "Two-line index fix authored against the read-only sys/ tree. Not buildable/runnable on the audit guest (no AMD GPU / no DC construct path).",
  "fix_evidence": "findings/poc/DF-4448/fix.diff"
}