{
  "finding_id": "DF-4554",
  "status": "not_reproduced",
  "reproduced": 0,
  "impact": "none",
  "confidence": "likely",
  "verdict": "Latent uninitialized-heap disclosure: amdgpu_debugfs_gpr_read() kmallocs 1024 dwords (unzeroed, line 710) and fills them only if the banks callback exists (lines 718-724), but the copy-out loop (729-742) runs unconditionally. Only gfx_v9_0.c defines .read_wave_vgprs in this tree, so on CIK/VI (gfx_v7_0.c:4283, gfx_v8_0.c:5325) a bank-0 VGPR read returns 4KB of uninitialized kernel heap \u2014 independent of DF-1692s offset unit confusion and surviving its fix. NOT reachable on DragonFly: CONFIG_DEBUG_FS is undefined in sys/dev/drm/kconfig.h, the DFly linux/debugfs.h shim declares no functions (the #if body would not even build), and runtime proof shows the shipped amdgpu.ko contains no handler symbols (nm/strings, run.log). Not reproduced on the guest: dead code + no AMD GPU.",
  "exploit_chain": "",
  "evidence": "run.log sections =C/=D/=E/=: nm of /boot/kernel/amdgpu.ko shows only amdgpu_debugfs_add_files and the #else stubs (amdgpu_debugfs_init/_regs_init/_regs_cleanup), no handler symbols; no amdgpu_regs/amdgpu_gpr strings; no /sys/kernel/debug; no AMD GPU. Source: gfx_v7_0.c:4283-4290 and gfx_v8_0.c:5325-5332 lack .read_wave_vgprs; contrast wave_reads !x guard at amdgpu_debugfs.c:647.",
  "kernel_refs": [
    "sys/dev/drm/amd/amdgpu/amdgpu_debugfs.c:710",
    "sys/dev/drm/amd/amdgpu/amdgpu_debugfs.c:718",
    "sys/dev/drm/amd/amdgpu/amdgpu_debugfs.c:729",
    "sys/dev/drm/amd/amdgpu/gfx_v7_0.c:4283",
    "sys/dev/drm/amd/amdgpu/gfx_v8_0.c:5325"
  ],
  "poc_changes": "authored from scratch this pass (no seed; finding filed this pass)",
  "attempts": 1,
  "guest_uname": "DragonFly dfbsd 6.5-DEVELOPMENT DragonFly 6.5-DEVELOPMENT #0: Thu Jul  2 06:02:54 UTC 2026 root@dfbsd:/usr/obj/usr/src/sys/X86_64_GENERIC x86_64",
  "runtime_sec": 20,
  "guest_dirty": 0,
  "build_cmd": "n/a (dead code on DFly)",
  "run_cmd": "sh run.sh (documents compiled-out proof: nm/strings on /boot/kernel/amdgpu.ko)",
  "code_hash": "ec737ccc01c8b690ff84908b411198ffbad94ef36ca200697ab7464f11b7a50f",
  "notes": "Reachability verdict for the whole file: amdgpu_debugfs.c is dead code on DFly today \u2014 compiled to #else stubs; also the IP-discovery dump and sclk handler named in later upstreams do not exist in this vintage; DF-1692/DF-1693 not re-reported.",
  "recommended_fix": "Fail the read (-EINVAL) when the selected banks callback is absent instead of copying an unfilled buffer (see fix.diff)",
  "fix_status": "not_testable",
  "fix_baseline_reproduced": 0,
  "fix_patched_reproduced": 0,
  "fix_verdict": "Not testable: handlers are compiled out on DFly and the guest has no AMD GPU; fix.diff is source-reviewed and git-apply-verified only",
  "fix_evidence": "fix.diff"
}