{
  "finding_id": "DF-4603",
  "poc_id": "DF-4603",
  "status": "untested",
  "reproduced": 0,
  "impact": "Permanent kernel mapping leak per failed move (VA pressure DoS), or full VRAM-aperture unmap when old BO sits at aperture offset 0 -> kernel panic on next premapped access",
  "confidence": "likely",
  "attempts": 0,
  "guest_uname": null,
  "code_hash": null,
  "exploit_chain": [],
  "evidence": "old_mem snapshotted BEFORE io_mem_reserve fills bus; the out: cleanups iounmap decision reads the stale copy - compounded by uninitialized stack-garbage bus installed into bo->mem by move_accel/TTM/null paths. Mitigating gates: memcpy path only when buffer_funcs disabled (SDMA-less/reset/suspend), VRAM offset 0 normally pinned by kernel allocs, garbage value stack-layout dependent. Distinct from DF-1747 (out1 wrong-mem pairing) - fix both together. No GPU on guest.",
  "kernel_refs": [
    "sys/dev/drm/ttm/ttm_bo_util.c:344",
    "sys/dev/drm/ttm/ttm_bo_util.c:357",
    "sys/dev/drm/ttm/ttm_bo_util.c:429",
    "sys/dev/drm/ttm/ttm_bo_util.c:430",
    "sys/dev/drm/ttm/ttm_bo_util.c:716"
  ],
  "verdict": "not_run: Low, amdgpu-hardware-dependent (buffer_funcs-disabled window + VRAM offset-0 BO); guest has no GPU",
  "fix_status": "not_testable",
  "fix_baseline_reproduced": 0,
  "fix_patched_reproduced": 0,
  "fix_verdict": "not_testable",
  "fix_evidence": "refresh-old_copy-after-reserves + memset(mem.bus) fix in finding markdown"
}