{
  "finding_id": "DF-4805",
  "status": "untested",
  "attempts": 0,
  "reproduced": 0,
  "impact": "dos",
  "confidence": "speculative",
  "verdict": "Speculative (datasheet-ambiguous zero-count edge), hardware-gated: amdsb_watchdog never clears AMDSB_WD_RUN - for period==0 (kern_wdogs documented disabled state and the sole input of panic-path wdog_disable) it programs COUNT=0, skips re-enable, and strokes RELOAD leaving the timer RUNNING with count 0; per SB RRG countdown semantics an armed zero count may act as a 1-tick fuse, turning an explicit disable into a hard reset. The correct disable idiom (amdsbwd_tmr_disable) exists and is used only on detach. Sibling ichwd shares the write-0-and-reload idiom (benign on Intel TCO at least). Distinct from DF-1890/2540 (overflow-derived count=0). timeout==0 -> real-disable fix.",
  "exploit_chain": "root: sysctl kern.watchdog.period=0 on armed hardware -> wdog: Disabled watchdog(s) but timer keeps running with COUNT=0 -> possible hard reset ~1 tick later",
  "evidence": "findings/poc/DF-4805/ (this verdict)",
  "kernel_refs": [
    "sys/dev/misc/amdsbwd/amdsbwd.c:220-225",
    "sys/dev/misc/amdsbwd/amdsbwd.c:179-189",
    "sys/kern/kern_wdog.c:163-166"
  ],
  "guest_uname": "",
  "code_hash": ""
}