# DF-4461 — PoC evidence pack

## What
Unprivileged-triggerable kernel panic in `amdtemp(4)` on AMD family 17h/19h
(Zen) CPUs: the CCD temperature read path asserts on live hardware state
(`AMDTEMP_17H_CCD_TMP_VALID`) instead of handling it, and the default kernel
config builds INVARIANTS in.

- File: `sys/dev/powermng/amdtemp/amdtemp.c`
- Lines: 946-971 (KASSERT at 966-967); probe-time contrast at 1012/1070;
  sysctl creation at 1019-1022/1077-1080; sensor task at 759-763.

## Build
```
./build.sh        # script-only PoC — nothing to compile
```

## Run (on an AMD Zen host, as any unprivileged user)
```
./run.sh          # polls dev.amdtemp.0.ccd0..ccd11 + core0.sensor0
```
Expected on affected hardware + INVARIANTS kernel: panic
`sensor %d: not valid` (serial console / /var/crash).

## Run on the audit guest (what actually happened)
```
dfbsd-qemu/vm.sh run_root 'su -m nobody -c sysctl dev.amdtemp.0.ccd0'
  -> sysctl: unknown oid 'dev.amdtemp.0.ccd0'   (rc=1)
```
The guest is QEMU with no AMD PCI devices; `amdtemp` never attaches, so the
vulnerable path is absent — see `run.log`, `env.txt`, `VERDICT.md`.

## Contents
- `amdtemp_ccd_read.sh`  minimal trigger
- `build.sh` / `run.sh`   exact commands
- `run.log`               decisive guest run (untrimmed)
- `env.txt`               guest environment
- `VERDICT.md`            full narrative + code trace
- `fix.diff`              proposed fix (never applied to sys/)
- `manifest.json` / `verdict.json`