{
  "finding_id": "DF-4555",
  "status": "not_reproduced",
  "reproduced": 0,
  "impact": "none",
  "confidence": "likely",
  "verdict": "Provable NULL-deref path: dc_link_aux_transfer() (dc_link_ddc.c:655-684) ignores aux_engine->funcs->acquire() failure; on failure engine->ddc is NULL (only set at dce_aux.c:894 on success, cleared at :60 on release), so its unconditional release_engine() (dce_aux.c:58) calls dal_ddc_close(NULL), which dereferences ddc->pin_clock without a NULL check (gpio_service.c:590) -> near-NULL read -> panic. Upstream Linux checks acquire() in dce_aux_transfer_raw_with_ddc_pin(), confirming the defect. Not reproduced on the audit guest because it has no AMD GPU (Bochs 0x1234:0x1111, zero 0x1002 devices; env.txt/run.log) and DragonFly compiles out the dp_aux chardev (drm_dp_aux_dev.c is #if 0), so the trigger requires an AMD-DC host with AUX/GPIO contention (hotplug vs retrain vs MST sideband). Defect certain from source; manifestation hardware-gated.",
  "exploit_chain": "",
  "evidence": "VERDICT.md (full path:line proof + upstream divergence); trigger.c (contention trigger doc); env.txt + run.log (guest hardware absence proof); fix.diff",
  "kernel_refs": [
    "sys/dev/drm/amd/display/dc/dce/dce_aux.c:53",
    "sys/dev/drm/amd/display/dc/dce/dce_aux.c:870",
    "sys/dev/drm/amd/display/dc/core/dc_link_ddc.c:655",
    "sys/dev/drm/amd/display/dc/gpio/gpio_service.c:587"
  ],
  "poc_changes": "Seed replaced: no runnable userspace trigger exists on DragonFly (dp_aux chardev compiled out, modesetting needs DRM master); trigger.c rewritten as documented contention recipe; run.log records the honest hardware-gated attempt.",
  "attempts": 1,
  "guest_uname": "DragonFly dfbsd 6.5-DEVELOPMENT DragonFly 6.5-DEVELOPMENT #0: Thu Jul  2 06:02:54 UTC 2026 root@dfbsd:/usr/obj/usr/src/sys/X86_64_GENERIC x86_64",
  "runtime_sec": 12,
  "guest_dirty": 0,
  "build_cmd": "n/a (conceptual trigger)",
  "run_cmd": "./run.sh",
  "code_hash": "",
  "notes": "Hardware-gated (AMD DC GPU required; guest has none). Realistic impact ceiling: kernel panic (local/physical DoS) under AUX arbitration/GPIO-open contention. No write primitive, no info leak; faulting address fixed near-NULL.",
  "recommended_fix": "Honor acquire() return in dc_link_aux_transfer() and make release_engine() NULL-safe (see fix.diff).",
  "fix_status": "not_testable",
  "fix_baseline_reproduced": 0,
  "fix_patched_reproduced": 0,
  "fix_verdict": "Fix not validated on guest: baseline cannot run (no AMD GPU). fix.diff is line-accurate against dce_aux.c:53-63 / dc_link_ddc.c:655-656 and mirrors upstreams acquire()-check; validated by inspection only.",
  "fix_evidence": "findings/poc/DF-4555/fix.diff"
}