{
  "finding_id": "DF-4736",
  "status": "inconclusive",
  "reproduced": 0,
  "impact": "none",
  "confidence": "certain",
  "verdict": "intel_hotplug.c:486-487 invokes dev_priv->display.hpd_irq_setup(dev_priv) without the NULL guard used by the sibling call sites at :244 and :532 in the same file. Reachability trace proves the pointer is non-NULL on every platform that can reach this code: intel_irq_init (i915_irq.c:4853-4916) leaves hpd_irq_setup NULL only on GMCH platforms with info.has_hotplug==0 (i915G/i915GM, gen2; i915_pci.c:130-141), and on exactly those platforms the gen3 IRQ handler gates the entire hotplug ack behind I915_HAS_HOTPLUG (i915_irq.c:4584-4586) so intel_hpd_irq_handler() is never called. The missing guard is therefore a latent NULL-function-pointer-call hazard for future platform additions, not a live bug: severity Info, impact none today. The audit QEMU guest has no Intel display device (pciconf: only 8086:1237/7000/7010/7113), so i915 never attaches and no runtime trigger can exist on this machine; verification is the static trace plus the live environment dead-end check.",
  "exploit_chain": "",
  "evidence": "README.md (asymmetry + kill-chain with citations), VERDICT.md (full trace), env.txt (guest pciconf: no Intel GPU; uname), guest_ichwd_inert.log (unrelated ichwd negative check, same guest), fix.diff (one-line guard)",
  "kernel_refs": [
    "sys/dev/drm/i915/intel_hotplug.c:486",
    "sys/dev/drm/i915/intel_hotplug.c:244",
    "sys/dev/drm/i915/intel_hotplug.c:532",
    "sys/dev/drm/i915/i915_irq.c:4853",
    "sys/dev/drm/i915/i915_irq.c:4916",
    "sys/dev/drm/i915/i915_irq.c:4584",
    "sys/dev/drm/i915/i915_pci.c:130",
    "sys/dev/drm/i915/i915_drv.h:2634"
  ],
  "poc_changes": "n/a \u2014 no runnable PoC: the trigger path is statically dead on every platform in the current i915_pci.c table and the guest has no Intel GPU; pack documents the reachability proof instead of a trigger.",
  "attempts": 1,
  "guest_uname": "DragonFly dfbsd 6.5-DEVELOPMENT DragonFly 6.5-DEVELOPMENT #0: Thu Jul  2 06:02:54 UTC 2026  root@dfbsd:/usr/obj/usr/src/sys/X86_64_GENERIC x86_64",
  "runtime_sec": 15,
  "guest_dirty": 0,
  "build_cmd": "n/a",
  "run_cmd": "n/a (see VERDICT.md: static trace + env.txt guest check)",
  "code_hash": "n/a",
  "notes": "Info/defense-in-depth. Adjacent pass-2 candidates investigated and killed are documented in the batch result negative_notes: stats[] OOB impossible (pin masks built only via for_each_hpd_pin over pin-indexed arrays, i915_irq.c:1705-1731), ->hotplug NULL at :366 impossible (callbacks paired with hpd_pin>=HPD_CRT at intel_crt.c:995-999, intel_hdmi.c:2439, intel_dp.c:6704, intel_ddi.c:3804, intel_sdvo.c:2521-2527; pin-0 encoders can never match event_bits since for_each_hpd_pin starts at 1), no irq_lock/mode_config.mutex AB-BA via drm_kms_helper_poll_enable (drm_probe_helper.c:222-258 takes no mutex; connector iter is spin+kref, drm_connector.c:585-668), unload re-queue race closed (intel_irq_uninstall before intel_modeset_cleanup, i915_irq.c:4964-4969, intel_display.c:16189-16212), storm count overflow impossible (count caps at threshold+1).",
  "recommended_fix": "Guard the storm reprogram call at intel_hotplug.c:486 exactly like :244/:532: add && dev_priv->display.hpd_irq_setup (see fix.diff).",
  "fix_status": "not_testable",
  "fix_baseline_reproduced": 0,
  "fix_patched_reproduced": 0,
  "fix_verdict": "n/a \u2014 Info hardening; no observable behavior differs on any existing platform (guard is a no-op for every reachable configuration) and the guest has no i915 hardware, so there is no baseline/patched comparison to run.",
  "fix_evidence": "fix.diff \u2014 one-line guard textually identical to the guards at intel_hotplug.c:244 and :532."
}