{
  "finding_id": "DF-4461",
  "status": "not_reproduced",
  "reproduced": 0,
  "impact": "none",
  "confidence": "likely",
  "verdict": "Not reproduced on the audit guest: it is QEMU with zero AMD (0x1022) PCI devices, so amdtemp cannot attach (amdtemp_match requires an AMD hostb id, amdtemp.c:288-306; SMN models additionally need an amdsmn child, amdtemp.c:536-543) and the dev.amdtemp.N.ccdX OIDs do not exist (run.log: unknown oid, guest stayed up). The code-path analysis is line-accurate and stands: amdtemp_gettemp17to19h KASSERTs on AMDTEMP_17H_CCD_TMP_VALID at amdtemp.c:966-967 for every CCD sysctl read (world-readable, amdtemp.c:1019-1022/1077-1080) and for the 2s periodic sensor task (amdtemp.c:759-763), while the drivers own probe paths treat the identical bit as possibly-clear (amdtemp.c:1012/1070). KASSERT panics under INVARIANTS (sys/sys/systm.h:94-96) which the default X86_64_GENERIC enables (sys/config/X86_64_GENERIC:56; guest kernel confirmed running it). On AMD Zen hardware this is an unprivileged local panic; claimed impact panic, observed impact none on this hardware-less guest.",
  "exploit_chain": "",
  "evidence": "run.log (unknown-oid as nobody + uptime proving guest alive; guest config greps), VERDICT.md (full path:line trace incl. probe-vs-read asymmetry), env.txt (uname/QEMU CPU/no AMD PCI), fix.diff (graceful handling replacing the KASSERT)",
  "kernel_refs": [
    "sys/dev/powermng/amdtemp/amdtemp.c:966",
    "sys/dev/powermng/amdtemp/amdtemp.c:1012",
    "sys/dev/powermng/amdtemp/amdtemp.c:1070",
    "sys/dev/powermng/amdtemp/amdtemp.c:1019",
    "sys/dev/powermng/amdtemp/amdtemp.c:759",
    "sys/sys/systm.h:94",
    "sys/config/X86_64_GENERIC:56",
    "sys/dev/powermng/amdsmn/amdsmn.c:280"
  ],
  "poc_changes": "Seed sketch reduced to its essence: the trigger is a pure unprivileged sysctl read loop (amdtemp_ccd_read.sh); no compilation needed. Guest-side execution via su -m nobody per the audit guest layout.",
  "attempts": 2,
  "guest_uname": "DragonFly dfbsd 6.5-DEVELOPMENT DragonFly 6.5-DEVELOPMENT #0: Thu Jul  2 06:02:54 UTC 2026  root@dfbsd:/usr/obj/usr/src/sys/X86_64_GENERIC  x86_64",
  "runtime_sec": 95,
  "guest_dirty": 0,
  "build_cmd": "./build.sh (script-only PoC; nothing to compile)",
  "run_cmd": "dfbsd-qemu/vm.sh run_root su -m nobody -c sysctl dev.amdtemp.0.ccd0 ; ./run.sh on an AMD Zen host",
  "code_hash": "eb901fb27fd680d8e04ce24735afb2799be560b082701d54f75b04732c20f919",
  "notes": "Hardware-gated: requires AMD family 17h/19h with CCD sensors. Secondary dead asserts noted in the same helper: KASSERT(error==0) at amdtemp.c:941/956/965 can never fire because amdsmn_read() (amdsmn.c:280-293) unconditionally returns 0. Fix validation not possible on this guest.",
  "recommended_fix": "Replace the read-time KASSERT on AMDTEMP_17H_CCD_TMP_VALID in amdtemp_gettemp17to19h with a graceful invalid-handling return, mirroring the probe-time skip in amdtemp_probe_ccd_sensors17h/19h.",
  "fix_status": "not_testable",
  "fix_baseline_reproduced": 0,
  "fix_patched_reproduced": 0,
  "fix_verdict": "fix.diff replaces the KASSERT with an early return of 0 for an invalid CCD reading (matching the probe-time semantics at amdtemp.c:1012/1070). Cannot be built/tested on the audit guest: the vulnerable path requires AMD SMN hardware which the QEMU guest does not emulate, so baseline never reproduced and the patched kernel would be equally untestable.",
  "fix_evidence": "fix.diff in this directory; guest hardware absence documented in run.log/env.txt"
}