# VERDICT DF-4499 — gfx_v9 KFD backend dead on DF; latent index-arithmetic hazards

## Bottom line

**Info finding; PoC execution skipped (not applicable — the finding IS the
unreachability).** Verified at source and guest level:

* `CONFIG_HSA_AMD` undefined tree-wide → `kgd2kfd = NULL`
  (`amdgpu_amdkfd.c:33-50`) → `amdgpu_amdkfd_device_probe()` early-returns
  (`:59-71`) → `adev->kfd` NULL → `amdgpu_amdkfd_is_kfd_vmid()` always false
  (`:514-523`) → every `kfd2kgd` entry exported by
  `amdgpu_amdkfd_gfx_v9.c:169-225` is unreachable, and no KFD frontend
  (`amd/amdkfd/`, `/dev/kfd`) exists in the tree to call them anyway.
* Guest: no 0x1002 PCI devices, no `/dev/dri`, no `/dev/kfd`, no drm KLDs
  (`env.txt`).

## Audit result for the exported functions (for the day KFD is enabled)

Confirmed in-bounds: hqd_load MQD walk (56 dwords, `v9_structs.h:289-344`),
hqd_dump/sdma_dump allocations+guards, tile_config ARRAY_SIZE over real
arrays, TLB vmid loop 0..15, fw_version NULL checks.

Latent hazards (unreachable today, fix when enabling):
1. `get_sdma_base_addr` `base[engine_id]` OOB for engine_id > 1 (MQD-sourced).
2. `kgd_set_pasid_vmid_mapping` `1U << (vmid+16)` / `+vmid` register walks
   with no local vmid bound.
3. `is_kfd_vmid` `(1 << vmid)` UB at vmid ≥ 32 (x86 shift-wrap can pass the
   0xFF00 test for vmid ≡ 8..15 mod 32 → `vmid*2` offsets up to +80 dwords in
   `set_vm_context_page_table_base`).
4. Unbounded `cpu_relax()` ACK polls (GPU hang → kernel thread hang).

`fix.diff` adds explicit `engine_id < 2` and `vmid < 16` guards in this file.

## Fix status (batch validation)
Applied with the 36 sibling fix.diffs of this batch in findings/poc/_batch41/all_fixes.patch; single in-guest `make -j6 nativekernel KERNCONF=X86_64_GENERIC` completed RC=0 with zero errors under -Werror (full log: findings/poc/_batch41/fix_build8.log). Behavior A/B intentionally skipped for this Info-tier item.