{
 "finding_id": "DF-4628",
 "poc_id": "DF-4628",
 "status": "untested",
 "reproduced": 0,
 "impact": "UAF write (gpiod_set_value mutates desc->flags/value) on first panel-enable after rebind; potentially exploitable if the freed chunk is reclaimed",
 "confidence": "speculative",
 "attempts": 0,
 "guest_uname": null,
 "code_hash": null,
 "exploit_chain": [],
 "evidence": "Function-static gpio table caches devm descriptors across device unbind/rebind with no invalidation. Per-device-table + clear-on-forget fix.",
 "kernel_refs": [
  "sys/dev/drm/i915/intel_dsi_vbt.c:304",
  "sys/dev/drm/i915/intel_dsi_vbt.c:305",
  "sys/dev/drm/i915/intel_dsi_vbt.c:319",
  "sys/dev/drm/i915/intel_dsi_vbt.c:322"
 ],
 "verdict": "not_run: BXT-class hardware + unbind/rebind cycle needed; speculative per pass-2 discipline",
 "fix_status": "not_testable",
 "fix_baseline_reproduced": 0,
 "fix_patched_reproduced": 0,
 "fix_verdict": "not_testable: hardware-gated (no Intel DSI panel / no mpt HBA on guest)",
 "fix_evidence": "fix in finding markdown"
}