{
 "finding_id": "DF-4747",
 "status": "reproduced",
 "reproduced": 1,
 "impact": "none",
 "confidence": "certain",
 "verdict": "Reproduced on the stock INVARIANTS guest with a KMOD that includes the real shim header (linux/hash.h): hash_64(x, 8) returns 0x0 for every input tested (0x1122334455667788, 0xdeadbeefcafebabe, 1) - the shim casts the 32-bit hash32_buf result to u64 and shifts right by (64 - bits) >= 32, which is identically zero (hash.h:32-38). chash.c (byte-identical to Linux v4.19, itself sound) calls hash_64(key, bits) at :398/:433 for 64-bit keys, so the amdgpu retry-fault chash (bits=8, amdgpu_vm.c) always probes slot 0 - linear-probe degradation, correctness preserved by the 50% fill cap. Post-fix A/B: the KMOD rebuilt against the patched tree returns nonzero, well-distributed values for bits=8 and 40. Fix = two independent 32-bit hashes concatenated; compile-validated via the KMOD rebuild (drm itself is module-built; the header is DRM-internal).",
 "exploit_chain": "",
 "evidence": "VERDICT.md with path:line citations; run.log where a live demo exists; fix.diff",
 "kernel_refs": [
  "sys/dev/drm/include/linux/hash.h:32",
  "sys/dev/drm/amd/lib/chash.c:398",
  "sys/dev/drm/amd/lib/chash.c:433"
 ],
 "poc_changes": "KMOD needed local u64/u32 typedefs + BITS_PER_LONG before including the DRM header (its include chain pulls kernel-only headers)",
 "attempts": 1,
 "guest_uname": "DragonFly dfbsd 6.5-DEVELOPMENT DragonFly 6.5-DEVELOPMENT #0: Thu Jul  2 06:02:54 UTC 2026     root@dfbsd:/usr/obj/usr/src/sys/X86_64_GENERIC  x86_64",
 "runtime_sec": 30,
 "guest_dirty": 0,
 "build_cmd": "see build.sh",
 "run_cmd": "see run.sh",
 "code_hash": "d22fe9d0e7856375740dbe66008338e9733161f9fedeec859c9e35ed9b183b56",
 "notes": "",
 "recommended_fix": "hash twice with different seeds and concatenate (real 64-bit mix)",
 "fix_status": "fixed",
 "fix_verdict": "A/B complete: the KMOD rebuilt against the patched header returns distinct nonzero values for bits=8 (0xe3/0x49/0x90) and 40 (0x72d3778c97); stock returned identically 0 for bits<=32."
}