{"finding_id":"DF-4755","status":"untested","attempts":0,"reproduced":0,"impact":"panic","confidence":"likely","verdict":"Source-certain init-ordering race, hardware-gated: requires an SR-IOV AMD VI VF (Tonga/Fiji) and a host/PF delivering the mailbox RCV interrupt in the window between amdgpu_irq_get(rcv_irq) at mxgpu_vi.c:600 (sets VALID_INT_EN) and INIT_WORK(flr_work) at :609 - schedule_work on the zeroed work_struct executes func==NULL via linux_workqueue.c:89. No SR-IOV AMD GPU on the QEMU guest, so runtime verification is not possible. Fix is a one-line reorder (INIT_WORK first), not yet build-validated.","exploit_chain":"host asserts mailbox RCV irq (src 135) right after guest VALID_INT_EN write; rcv_irq matches IDH_FLR_NOTIFICATION; schedule_work(&adev->virt.flr_work) with uninitialized work; process_all_work calls NULL func -> guest kernel panic","evidence":"findings/poc/DF-4755/ (this verdict; reviewer notes in DF-4754 batch record)","kernel_refs":["sys/dev/drm/amd/amdgpu/mxgpu_vi.c:600","sys/dev/drm/amd/amdgpu/mxgpu_vi.c:609","sys/dev/drm/amd/amdgpu/mxgpu_vi.c:555","sys/dev/drm/linux_workqueue.c:89"],"guest_uname":"","code_hash":""}