{
  "finding_id": "DF-4732",
  "status": "untested",
  "reproduced": 0,
  "impact": "none",
  "confidence": "likely",
  "verdict": "DragonFly-port protocol violation: DM_IRQ_TABLE_LOCK (amdgpu_dm_irq.c:50) maps to local_irq_save+lockmgr(LK_EXCLUSIVE) (spinlock.h:75-78) on a lock initialized with lockinit/LK_CANRECURSE (:305), and is acquired from the GPU interrupt dispatch path (amdgpu_dm_irq_handler :476 -> amdgpu_dm_irq_immediate_work :452 / amdgpu_dm_irq_schedule_work :427), which runs in the serializer-backed ithread installed by request_irq->bus_setup_intr (linux_irq.c:84-86). lockmgr may sleep; sleeping in a serialized ithread with the interrupt serializer held and hardware IRQs force-disabled is illegal on DragonFly -> panic/deadlock ceiling when an interrupt contends with a process-context holder (amdgpu_dm_irq_suspend holds the lock across dc_interrupt_set MMIO at :345-:363; immediate_work itself holds it across vblank/pflip handler dispatch at :464). Untestable on this guest: no AMD GPU, no /dev/dri, no drm kld (env.txt). DFly-specific divergence - upstream v4.17 uses a true spinlock (diffed).",
  "exploit_chain": "theoretical only: unprivileged desktop user on AMD hardware generates flip/vblank/HPD interrupt pressure concurrent with amdgpu_dm_irq_suspend (suspend/resume cycle) -> GPU ithread blocks in lockmgr -> panic (local DoS). No privesc path: no attacker-controlled data crosses the lock boundary.",
  "evidence": "VERDICT.md acquisition-chain walk with path:line for every hop (linux_irq.c:84 -> amdgpu_irq.c:189/:397 -> amdgpu_dm_irq.c:476/:452/:427); env.txt documents absent hardware",
  "kernel_refs": [
    "sys/dev/drm/amd/display/amdgpu_dm/amdgpu_dm_irq.c:50",
    "sys/dev/drm/amd/display/amdgpu_dm/amdgpu_dm_irq.c:305",
    "sys/dev/drm/amd/display/amdgpu_dm/amdgpu_dm_irq.c:345",
    "sys/dev/drm/amd/display/amdgpu_dm/amdgpu_dm_irq.c:427",
    "sys/dev/drm/amd/display/amdgpu_dm/amdgpu_dm_irq.c:452",
    "sys/dev/drm/amd/display/amdgpu_dm/amdgpu_dm_irq.c:476",
    "sys/dev/drm/include/linux/spinlock.h:75",
    "sys/dev/drm/linux_irq.c:84"
  ],
  "poc_changes": "n/a - no runtime PoC possible (hardware-gated); static acquisition-chain proof only",
  "attempts": 0,
  "guest_uname": "DragonFly dfbsd 6.5-DEVELOPMENT #0: Thu Jul  2 06:02:54 UTC 2026 root@dfbsd:/usr/obj/usr/src/sys/X86_64_GENERIC x86_64",
  "runtime_sec": 0,
  "guest_dirty": 0,
  "build_cmd": "n/a (requires AMD GPU)",
  "run_cmd": "n/a (requires AMD GPU; trigger = interrupt pressure vs suspend)",
  "code_hash": "",
  "notes": "Guest left clean. This is the systemic DFly drm-port pattern (spinlock_t==struct lock) manifesting in this files ISR-reachable lock; filed here because amdgpu_dm_irq.c is where the interrupt-context acquisition is direct.",
  "recommended_fix": "Convert irq_handler_list_table_lock to a true struct spinlock (crit_enter+spin_lock in DM_IRQ_TABLE_LOCK macros; spin_init at amdgpu_dm_irq_init), matching upstream irqsave semantics - see fix.diff",
  "fix_status": "not_testable",
  "fix_baseline_reproduced": 0,
  "fix_patched_reproduced": 0,
  "fix_verdict": "Cannot kernel-validate without AMD GPU. fix.diff restores upstream non-sleeping semantics; no recursion on this lock exists in the file (audited: no high-context handler re-acquires the table lock), so the loss of LK_CANRECURSE is safe.",
  "fix_evidence": "fix.diff; VERDICT.md Fix validation section"
}