# DF-4741 — drm_sched_fini returns with an armed work_tdr / undrained job list → post-teardown UAF

## Build

Same harness as DF-4740 (`df4740.c`, `Makefile`) — see ../DF-4740/README.md.

## Run

```
kldload amdgpu
kldload /tmp/df4740/df4740.ko
sysctl hw.df4740_test=2
```

## Expected (baseline, unpatched scheduler — observed, panic.txt)

```
[DF4741] job ... in flight, work_tdr armed (timeout=200 ticks); calling drm_sched_fini()
[DF4741] drm_sched_fini() returned WITHOUT cancelling work_tdr ...
[DF4741] reclaim block 0 at 0xfffff8008f844440 (zeroed)   <- exact freed sched address
...
panic: _callout 0xfffff8008f968b80 verifier 0xfffff8008f844630 toc 0 (expected ...) func ...
softclock_handler() at softclock_handler+0x502
Debugger("panic")
```

The armed `work_tdr` delayed-work callout fires on the freed (and reclaimed)
scheduler ~1-2 s after `drm_sched_fini()` returned and the caller freed the
scheduler, exactly as `amdgpu_fence_driver_fini()` (amdgpu_fence.c:495-519)
frees `struct amdgpu_ring` (which embeds `ring->sched`) right after
`drm_sched_fini(&ring->sched)`.

## Post-fix (fix.diff adds cancel_delayed_work_sync to drm_sched_fini)

`run_fixed.log`: same test on the patched amdgpu.ko — no callout fire, no
panic, guest stays up ("STILL-UP-4s").