{
  "finding_id": "DF-4737",
  "status": "not_reproduced",
  "reproduced": 0,
  "impact": "none",
  "confidence": "certain",
  "verdict": "Logic defect certain by C semantics and proven by a guest-compiled replica of the exact amdpm_wait loop (run.log: perpetual-BUSY -> error=0x0, SMB_ETIMEOUT never reported; final-poll completion -> error=0x20, spurious failure). The in-kernel path is hardware-gated: no AMD 756/766/768/8111 PMU (1022:740b/7413/7443/746b) or nForce SMBus (10de:01b4) PCI device exists in the QEMU guest (guest_hw_evidence.txt), so amdpm.ko loads but never attaches and the smbus interface is unreachable (/dev/smb* absent). Surface is root-only where it does exist (0600 root:wheel /dev/smbN, smb.c:135-141) plus in-kernel smbus consumers; impact is silent wrong-data/missing-error (data integrity), not memory corruption \u2014 bwrite clamps 1..32 at amdpm.c:548 and breads buffer writes are guarded at amdpm.c:618. Same while(count--)/if(!count) defect family as DF-4549 (viapm.c:574/587); intpm.c:560-585 shows the correct explicit-return pattern.",
  "exploit_chain": "",
  "evidence": "run.log (guest cc 8.3 build + both failure modes + fixed-loop validation); guest_hw_evidence.txt (pciconf: no 1022/10de PMU device; kldload amdpm succeeds, no attach, no /dev/smb*); VERDICT.md (line-by-line root cause at amdpm.c:308/319)",
  "kernel_refs": [
    "sys/dev/powermng/amdpm/amdpm.c:308",
    "sys/dev/powermng/amdpm/amdpm.c:319",
    "sys/dev/powermng/amdpm/amdpm.c:420",
    "sys/dev/powermng/amdpm/amdpm.c:476",
    "sys/dev/powermng/amdpm/amdpm.c:532",
    "sys/dev/powermng/amdpm/amdpm.c:613"
  ],
  "poc_changes": "No seed existed; authored host-side replica of the amdpm_wait loop with fixture register reads plus an in-demo fixed-loop variant, compiled and executed on the guest (no host compiler available).",
  "attempts": 2,
  "guest_uname": "DragonFly dfbsd 6.5-DEVELOPMENT DragonFly 6.5-DEVELOPMENT #0: Thu Jul 2 06:02:54 UTC 2026     root@dfbsd:/usr/obj/usr/src/sys/X86_64_GENERIC  x86_64",
  "runtime_sec": 300,
  "guest_dirty": 0,
  "build_cmd": "cc -Wall -Wextra -o /tmp/df4737 /tmp/df4737.c (on guest)",
  "run_cmd": "/tmp/df4737 (on guest)",
  "code_hash": "f2208dd21bda0eb42b5c1e36f1413807af05d0ba4dbbed0381deac53399a4da3",
  "notes": "amdpm.ko was kldloaded for hardware-gate evidence and kldunloaded afterwards; guest returned clean (no panic, no reset needed). Attack surface root-only: /dev/smbN is 0600 root:wheel (smb.c:135-141).",
  "recommended_fix": "Change `if (!count)` to `if (count < 0)` in amdpm_wait() at amdpm.c:319 (loop exhaustion leaves count == -1; completion on the final poll leaves count == 0 and must not be a timeout).",
  "fix_status": "not_testable",
  "fix_baseline_reproduced": 0,
  "fix_patched_reproduced": 0,
  "fix_verdict": "not_testable: kernel path requires AMD/nForce PMU hardware absent from the guest; the one-line diff is validated in-silico by the demos fixed-loop variant (case A would report SMB_ETIMEOUT, case B would report success \u2014 run.log).",
  "fix_evidence": "fix.diff"
}