{"finding_id":"DF-4756","status":"untested","attempts":0,"reproduced":0,"impact":"dos","confidence":"certain","verdict":"Source-certain hardirq stall, hardware-gated: xgpu_vi_mailbox_rcv_irq runs in the amdgpu_irq .process path and synchronously calls xgpu_vi_mailbox_send_ack (mxgpu_vi.c:383) which busy-waits up to VI_MAILBOX_TIMEDOUT(12000) x mdelay(1) = 12s for the host to clear RCV_MSG_VALID - a withholding PF freezes the guest interrupt context 12s per notification, repeatable at irq-storm rate. No SR-IOV AMD hardware on guest. Fix: defer the ack handshake to the already-existing flr_work (peek instead of recv) or cap the inline wait.","exploit_chain":"host sends FLR notification and never clears RCV_MSG_VALID after guest ACK -> 12s hardirq busy-wait per delivery -> soft-lockup/watchdog guest DoS","evidence":"findings/poc/DF-4756/ (this verdict; reviewer notes in DF-4754 batch record)","kernel_refs":["sys/dev/drm/amd/amdgpu/mxgpu_vi.c:318-340","sys/dev/drm/amd/amdgpu/mxgpu_vi.c:383","sys/dev/drm/amd/amdgpu/mxgpu_vi.c:551","sys/dev/drm/amd/amdgpu/amdgpu_irq.c:189-199"],"guest_uname":"","code_hash":""}