# DF-4748 — PoC evidence pack (verbatim-code rig)

Use-after-free of `amdgpu_dm_connector` via stale `dc_sink->priv`:
`sys/dev/drm/amd/display/amdgpu_dm/amdgpu_dm_helpers.c:197/289/317`
dereference `stream->sink->priv` after the connector was freed by the MST
unplug path; the sink stays alive holding the dangling back-pointer
because the enabled `dc_stream_state` keeps its own sink reference.

## Status: REPRODUCED (verbatim rig; hardware-gated in-kernel)

The audit guest has no AMD GPU (Bochos stdvga only, no /dev/dri), so the
finding is verified with the proven verbatim-code rig (DF-4165/4247/4631
evidence class):

1. **Build** (on the DragonFly guest):

```sh
scp -r rig fix.diff dfbsd:/root/df4748/    # or tar
ssh dfbsd 'sh /root/df4748/rig/build.sh /usr/src'
# -> regenerates the slices FROM /usr/src, verifies all 66 VERBATIM
#    blocks byte-identical + fix.diff round-trip, builds rig_base
#    (verbatim production) and rig_fixed (verbatim + fix.diff)
```

2. **Run** (all scenarios, baseline then fixed, 3x deterministic):

```sh
ssh dfbsd 'sh /root/df4748/rig/run.sh'
```

3. **Expected** (see VERDICT.md for the full matrix):
   - baseline `disable-guard`: exit 77,
     `RIG FAULT: addr=… INSIDE FREED allocation 'dm_dp_add_mst_connector' — USE-AFTER-FREE CONFIRMED`
     (the `mst_port` member read at amdgpu_dm_helpers.c:199);
   - baseline `disable-groom` / `enable-groom`: exit 77,
     `CONTROLLED-WRITE PROVEN` — verbatim payload machinery writes at an
     attacker-chosen address;
   - `disable-poison`: exit 77 (wild pointer);
   - `disable-stale`/`disable-zero`: exit 0 (latent read — honest
     latency of the bug class);
   - fixed build: **every** scenario exit 0, victim byte-identical in
     groom (FIX_BLOCKED_WRITE).

## Contents

- `rig/` — the verbatim rig: `gen_rig.sh` (machine-extract),
  `check_verbatim.sh` (byte-identity proof, host + guest),
  `mst_rig.c` (harness), `rig_shims.h`/`rig_types.h` (infrastructure
  shims, no defect logic), generated slices, `Makefile`, `build.sh`,
  `run.sh`, full logs (`build.log`, `run.log`, `run.2.log`, `run.3.log`)
- `fix.diff` — one-line back-pointer clear in
  `dm_dp_destroy_mst_connector` (git-apply-able against sys/; validated
  A/B in the rig AND by a real amdgpu.ko module build on the guest)
- `fix_build.log` — real-module compile validation (pristine + patched)
- `fix_run.log` — fixed-build scenario matrix (all clean)
- `verdict.json` / `manifest.json` — machine verdict
- `verify.sh` + `static_proof.log` — original static chain proof (8/8,
  still valid)
- `env.txt` — guest environment (no GPU PCI device)

## On-hardware procedure (for a machine with an AMD ASIC + MST dock)

Display active on an MST child monitor → unplug that monitor (dock stays
connected) → let the session reconfigure (CRTC off / replug) →
`dm_helpers_dp_mst_*` hit the freed connector; slab state decides
crash-vs-corruption, per the rig's free-mode models.