# DF-4826 VERDICT — dead translation unit; DF-1907/08/09/10 unreachable

**Status: reproduced (the dead-code claim), impact: none, confidence: certain.**

## What was claimed (pass-2 reachability question)

The pass-2 task for `sys/dev/drm/amd/amdgpu/amdgpu_acp.c` was to determine
which of the known findings (DF-1907 pp_funcs NULL deref in `acp_poweron`;
DF-1908 `dev_info(NULL,...)` in `get_mfd_cell_dev`; DF-1909 genpd dangling in
a global list after `acp_hw_fini`; DF-1910 `i2s_pdata` leak) are actually
reachable given the state of the DragonFly linux-compat shims.

## Answer: none of them — the translation unit is never built

Five independent proofs, all reproduced in `run.log`:

1. **Not in the build.** `sys/dev/drm/amd/amdgpu/Makefile` (67 SRCS lines,
   explicit lists, no wildcards) never mentions `amdgpu_acp.c`. The only
   grep hit for "amdgpu_acp" is `amdgpu_acpi.c` (line 168) — a different
   file whose presence is the positive control.
2. **Cannot compile even if added.** `amdgpu_acp.c:27` includes
   `<linux/pm_domain.h>` and `:29-30` include `<sound/designware_i2s.h>` /
   `<sound/pcm.h>`. None of these headers exist:
   `sys/dev/drm/include/linux/` contains only `pm.h`, `pm_qos.h`,
   `pm_runtime.h`, and the `sys/dev/drm/include/sound/` directory does not
   exist at all. Any compile attempt dies at line 27.
3. **Config gate never opens.** `CONFIG_DRM_AMD_ACP` is only ever consumed
   (`#ifdef` at amdgpu.h:823 guarding `struct amdgpu_device::acp`;
   `#if defined` at vi.c:74, vi.c:1685, vi.c:1706 guarding the
   `acp_ip_block` IP-block registration on CZ/Stoney;
   smu8_hwmgr.c:667) and never defined anywhere in the tree. Without it,
   `adev->acp` does not even exist as a struct member, so no caller-side
   path can reach ACP state either.
4. **The shims the code depends on do not exist.** DFly has no mfd and no
   genpd implementation: `sys/dev/drm/include/linux/mfd/core.h` is an empty
   include-guard; `struct platform_device` is an empty struct
   (`platform_device.h:36-37`); `mfd_add_hotplug_devices`,
   `mfd_remove_devices`, `pm_genpd_init`, `pm_genpd_add_device`,
   `pm_genpd_remove_device`, `bus_find_device_by_name`,
   `struct generic_pm_domain`, `struct mfd_cell`, `struct i2s_platform_data`
   appear in exactly one file of the whole `sys/` tree: amdgpu_acp.c itself.
   There is no `platform_bus_type`, no cell device creation, no pdata
   `probe` callback that could re-enter this file.
5. **The shipped binary agrees.** On the audit guest
   (DragonFly v6.5.0.1712.g89e6a-DEVELOPMENT),
   `nm /boot/kernel/amdgpu.ko | grep -cE 'acp_ip_block|acp_hw_init|acp_poweron'`
   → **0**, while the acpi control (`grep -ci acpi`) → 17. The module that
   ships with the OS contains no ACP code.

## Consequence for the known findings (do not re-file; re-triage)

- **DF-1907** (`acp_poweron` pp_funcs NULL deref, amdgpu_acp.c:159): latent
  in vendored source only. Runtime trigger requires `acp_ip_block` to be
  registered, which requires `CONFIG_DRM_AMD_ACP`, which is never defined.
- **DF-1908** (`dev_info(dev,...)` with `dev==NULL`, amdgpu_acp.c:173):
  latent only; additionally `bus_find_device_by_name`/`platform_bus_type`
  have no implementation in this tree, so even a compiled-in file would fail
  at link time.
- **DF-1909** (genpd left in global list / freed in `acp_hw_fini`,
  amdgpu_acp.c:228/463): latent only; `pm_genpd_init` has no DFly
  implementation and no global genpd list exists.
- **DF-1910** (`i2s_pdata` leak, amdgpu_acp.c:242): latent only.

All four remain valid *upstream Linux/vendored-source* observations worth
carrying in future drm syncs (upstream Linux reworked this file heavily after
4.x), but none is reachable on DragonFly as shipped.

## Latent shapes analyzed in pass 2 and killed by the same dead-TU fact

For the record (these are *additional* latent defects found this pass; all
unreachable for the same reason, so not filed separately):

- **Error-path lifetime**: `acp_hw_init` calls `pm_genpd_init` at :228
  before the `kcalloc`s at :230/:236/:242; a later allocation failure
  returns -ENOMEM leaving `acp_genpd` initialized, and :238/:245 `kfree`
  `acp_res`/`acp_cell` while the pointers stay dangling in `adev->acp`.
  The subsequent `acp_hw_fini` would then walk `adev->acp.acp_cell[i].name`
  at :454 → NULL/UAF read. Requires kcalloc failure on dead code — not
  reachable.
- **Timeout paths leak state**: the `-ETIMEDOUT` returns at :369/:385 (and
  fini's :431/:447) skip `mfd_remove_devices`/genpd teardown; recovery
  depends on the IP-fin callback running. Dead code — not reachable.
- **The register-wait loops are bounded** (0xFF iterations × udelay(100) ≈
  25.5 ms per loop, amdgpu_acp.c:361-372, 378-389, 423-434, 440-451) —
  the "infinite wait" hypothesis is killed: they are not infinite.
- **Cell/resource bookkeeping is in-bounds**: ACP_DEVS=4 cells over a 4-entry
  `kcalloc`, 5 resources over a 5-entry `kcalloc`, `num_resources` 5/1/1/1
  consistent with the resource array — no OOB shape exists (amdgpu_acp.c:230-338).
- **No firmware path, no audio-component interplay** exists in this file
  (no `component_add`, no audio-component registration).

## Fix

No kernel fix required — the code is not built. Triage action: mark
DF-1907/DF-1908/DF-1909/DF-1910 `deferred`/`latent (dead code on DFly)` and
carry the notes into the next drm vendor sync; optionally delete the file
locally to prevent confusion (vendored-tree hygiene, not security).

## Fix status (batch validation)
Applied with the 36 sibling fix.diffs of this batch in findings/poc/_batch41/all_fixes.patch; single in-guest `make -j6 nativekernel KERNCONF=X86_64_GENERIC` completed RC=0 with zero errors under -Werror (full log: findings/poc/_batch41/fix_build8.log). Behavior A/B intentionally skipped for this Info-tier item.

(No fix.diff for this item: documented recommendation only - see Fix above.)