# DF-4584 evidence pack — radeon surface-reg steal race

* **Finding**: `radeon_bo_get_surface_reg()` steals surface registers from
  other BOs without any lock protecting the victim → NULL-deref panic /
  slab UAF write (`old_object->surface_reg = -1` on freed `radeon_bo`).
* **File**: `sys/dev/drm/radeon/radeon_object.c:601-669` (steal scan + clear).
* **Trigger**: `df4584_trigger.c` (self-contained, pthreads; render node or
  card node).

## Build

```sh
cc -O2 -Wall -pthread -o df4584_trigger df4584_trigger.c   # → build.log
```

## Run

```sh
./df4584_trigger /dev/dri/renderD128                        # → run.log
./df4584_trigger /dev/dri/card0
```

## Expected

* On vulnerable radeon hardware: kernel panic (NULL deref at
  radeon_object.c:628/:641) within minutes of racing, or slab corruption
  reports (`zone corruption` / debug output) from the UAF write at :642.
* On this audit guest: exit 2 with
  `open /dev/dri/renderD128: No such file or directory` — no radeon GPU
  (virtio VGA only), no radeonkms.ko.  See `env.txt`, `run.log`.

## Contents

* `df4584_trigger.c` — race trigger (two pthreads: register vs destroy)
* `build.sh` / `run.sh` — exact commands
* `build.log` / `run.log` — full guest output (untrimmed)
* `env.txt` — guest environment proof
* `VERDICT.md` — full narrative + interleaving analysis
* `fix.diff` — device-lock fix (git-apply-able; not applied to sys/)
* `manifest.json` / `verdict.json` — machine-readable results