{
 "finding_id": "DF-4570",
 "poc_id": "DF-4570",
 "status": "untested",
 "reproduced": 0,
 "impact": "UAF read/write on freed engine->breadcrumbs at driver unload (panic-class; worse on heap reuse)",
 "confidence": "likely",
 "attempts": 0,
 "guest_uname": null,
 "code_hash": null,
 "exploit_chain": [],
 "evidence": "Drain order (fake_irq before hangcheck) is wrong given hangcheck re-arms fake_irq at its end; v4.14 had the correct order - inherited from the newer generation. Swap-the-drains fix.",
 "kernel_refs": [
  "sys/dev/drm/i915/intel_breadcrumbs.c:127",
  "sys/dev/drm/i915/intel_breadcrumbs.c:840",
  "sys/dev/drm/i915/intel_breadcrumbs.c:844",
  "sys/dev/drm/i915/intel_breadcrumbs.c:893"
 ],
 "verdict": "not_run: Low severity + no Intel GPU on guest; static race timeline in finding",
 "fix_status": "not_testable",
 "fix_baseline_reproduced": 0,
 "fix_patched_reproduced": 0,
 "fix_verdict": "not_testable: no Intel GPU on guest",
 "fix_evidence": "fix in finding markdown"
}