DF-4605 / run.log
===== extracted guard.inc (amdgpu_acpi.c:374-385) =====
1 /* Is this actually our event? */
2 if (!atif ||
3 !atif->notification_cfg.enabled ||
4 type != atif->notification_cfg.command_code) {
5 /* These events will generate keypresses otherwise */
6 #if 0
7 if (event->type == ACPI_VIDEO_NOTIFY_PROBE)
8 return NOTIFY_BAD;
9 else
10 return NOTIFY_DONE;
11 #endif
12 }
===== extracted deref.inc (amdgpu_acpi.c:387) =====
1 if (atif->functions.sbios_requests) {
===== guard_fixed.inc (proposed fix applied) =====
1 /* Is this actually our event? */
2 if (!atif ||
3 !atif->notification_cfg.enabled ||
4 type != atif->notification_cfg.command_code) {
5 /* These events will generate keypresses otherwise */
6 return; }
===== build (kernel-style -O2) =====
===== run BASELINE (gutted guard, verbatim kernel lines) =====
sizeof(struct amdgpu_atif)=40 offsetof(functions.sbios_requests)=18
RESULT: SIGSEGV at address 0x12 (=&atif->functions.sbios_requests with atif==NULL, expected 0x12)
VERDICT: guard body compiled to NOTHING; control fell through the if() into the NULL deref
baseline exit=42
===== run FIXED (guard with restored return) =====
sizeof(struct amdgpu_atif)=40 offsetof(functions.sbios_requests)=18
RESULT: no fault — guard returned early (finding REFUTED in this mode)
fixed exit=0
PROOF-OK: baseline faults at NULL+0x12; fixed variant returns cleanly
workdir: /tmp/df4605.bVE3GL