{
  "finding_id": "DF-4578",
  "status": "untested",
  "reproduced": 0,
  "impact": "none",
  "confidence": "certain",
  "verdict": "Info finding verified by source and guest inspection (sibling of DF-4499): the entire gfx8 kfd2kgd backend of amdgpu_amdkfd_gfx_v8.c is dead code on DragonFly \u2014 the file is not in any SRCS list (only amdgpu_amdkfd.c is built, Makefile:155-156), CONFIG_HSA_AMD is undefined tree-wide so amdgpu_amdkfd_init() forces kgd2kfd=NULL and device_probe() early-returns, the #ifndef stub provides the linking get_functions(), and no amd/amdkfd frontend exists at all. No PoC is applicable: the unreachability itself is the verified fact; the guest has no AMD PCI device and no /dev/dri. Latent enable-day hazards are documented and guarded by fix.diff: (1) kgd_set_pasid_vmid_mapping unvalidated vmid -> OOB MMIO writes past the 16-entry ATC/IH banks + 1U<<vmid UB + unbounded cpu_relax poll; (2) uint8_t vmid in the two ATC mapping getters -> OOB MMIO read up to +255 dwords; (3) get_fw_version dereferences fw->data before the hdr==NULL guard \u2014 mec2_fw is NULL on num_mec==1 VI parts (TOPAZ/STONEY) and sdma.instance[1].fw NULL on single-instance parts; (4) unchecked MQD-sourced engine/queue ids multiplied into MMIO offsets; (5) division by num_pipe_per_mec without zero check. Verified in-bounds (negative results): MQD register walks 0x3245-0x326c / 0x326f-0x3278 map 1:1 onto vi_structs.h:289-340 with headroom to :417; hqd_dump 54+4 count exact and WARN_ON_ONCE-guarded; get_tile_config uses ARRAY_SIZE over the fixed [32]/[16] arrays; invalidate_tlbs loops vmid<16 behind is_kfd_vmid; set_vm_context_page_table_base/invalidate_tlbs_vmid are is_kfd_vmid-gated.",
  "exploit_chain": "",
  "evidence": "env.txt (guest: no 0x1002 devices, /dev/dri absent, no drm KLDs; build tree: no Makefile reference, no CONFIG_HSA_AMD); run.log; VERDICT.md (in-bounds confirmations + latent hazards with path:line); fix.diff (vmid<16, engine/queue<2, fw-NULL guards)",
  "kernel_refs": [
    "sys/dev/drm/amd/amdgpu/amdgpu_amdkfd_gfx_v8.c:245-270",
    "sys/dev/drm/amd/amdgpu/amdgpu_amdkfd_gfx_v8.c:291-300",
    "sys/dev/drm/amd/amdgpu/amdgpu_amdkfd_gfx_v8.c:486-492",
    "sys/dev/drm/amd/amdgpu/amdgpu_amdkfd_gfx_v8.c:702-720",
    "sys/dev/drm/amd/amdgpu/amdgpu_amdkfd_gfx_v8.c:778-833",
    "sys/dev/drm/amd/amdgpu/amdgpu_amdkfd.c:34-47",
    "sys/dev/drm/amd/amdgpu/amdgpu_amdkfd.c:57-71",
    "sys/dev/drm/amd/amdgpu/amdgpu_amdkfd.c:554-557",
    "sys/dev/drm/amd/amdgpu/Makefile:155-156",
    "sys/dev/drm/amd/amdgpu/gfx_v8_0.c:2029-2041",
    "sys/dev/drm/amd/amdgpu/sdma_v3_0.c:1114-1118"
  ],
  "poc_changes": "not applicable (no trigger exists; verification = dead-code proof + guest device-absence evidence)",
  "attempts": 1,
  "guest_uname": "DragonFly dfbsd 6.5-DEVELOPMENT DragonFly 6.5-DEVELOPMENT #0: Thu Jul  2 06:02:54 UTC 2026 root@dfbsd:/usr/obj/usr/src/sys/X86_64_GENERIC x86_64",
  "runtime_sec": 30,
  "guest_dirty": 0,
  "build_cmd": "",
  "run_cmd": "grep -rn amdgpu_amdkfd_gfx_v8 sys/dev/drm/amd/amdgpu/Makefile sys/dev/drm/amd/Makefile; grep -rn define CONFIG_HSA_AMD sys/; guest: pciconf -l | grep 1002; ls /dev/dri",
  "code_hash": "",
  "notes": "Info severity: PoC skipped per contract (Low/Info). Status untested chosen from the strict set (DF-4499 used inconclusive before untested was available); the dead-code claim itself is certain. Guest left pristine (read-only commands only).",
  "recommended_fix": "when enabling KFD: apply fix.diff guards (vmid<16 in set_pasid_vmid_mapping and both ATC mapping getters, fw-pointer NULL checks before deref in get_fw_version, engine/queue<2 bounds in SDMA paths) and bound the cpu_relax poll with a timeout",
  "fix_status": "not_testable",
  "fix_baseline_reproduced": 0,
  "fix_patched_reproduced": 0,
  "fix_verdict": "fix.diff authored against read-only sys/ as hardening for currently dead code; no runtime validation applicable on this guest (no AMD hardware, file not built)",
  "fix_evidence": "fix.diff"
}