{
  "finding_id": "DF-4839",
  "status": "not_reproduced",
  "reproduced": 0,
  "impact": "none",
  "confidence": "speculative",
  "verdict": "Static-only verification. drm_primary_helper_update() (drm_plane_helper.c:215-288, default update_plane for drm_crtc_init() primary planes used by radeon/amdgpu dce_*) panics via BUG_ON at drm_plane_helper.c:265 when DRM_IOCTL_MODE_SETPLANE targets the primary plane of an enabled CRTC that has zero encoder-bound connectors. Well-formed ioctl sequences cannot create that state (legacy set_config requires >=1 connector to enable), but the DF-4469-family fail-path corruption in drm_crtc_helper.c can, converting a latent inconsistency into a one-ioctl local DoS for a DRM master. Not reproduced live: the audit guest has no DRM device at all (QEMU std-VGA; /dev/dri* and /dev/drm* absent), so SetPlane is not issuable; PoC deliberately skipped per contract for an Info hardening finding. Recommended hardening: return -EINVAL instead of BUG_ON (fix.diff).",
  "exploit_chain": "",
  "evidence": "findings/poc/DF-4839/VERDICT.md (full line-cited ioctl->BUG_ON trace); fix.diff (BUG_ON -> -EINVAL)",
  "kernel_refs": ["sys/dev/drm/drm_plane_helper.c:265", "sys/dev/drm/drm_plane_helper.c:264", "sys/dev/drm/drm_plane_helper.c:156-160", "sys/dev/drm/drm_plane_helper.c:246-253", "sys/dev/drm/drm_plane.c:774-825", "sys/dev/drm/drm_plane.c:647-700", "sys/dev/drm/drm_modeset_helper.c:104-119"],
  "poc_changes": "no PoC authored: Info hardening finding; guest lacks any DRM device so SetPlane cannot be exercised (noted in VERDICT.md)",
  "attempts": 0,
  "guest_uname": "DragonFly dfbsd 6.5-DEVELOPMENT DragonFly 6.5-DEVELOPMENT #0: Thu Jul  2 06:02:54 UTC 2026 root@dfbsd:/usr/obj/usr/src/sys/X86_64_GENERIC x86_64",
  "runtime_sec": 0,
  "guest_dirty": 0,
  "build_cmd": "",
  "run_cmd": "",
  "code_hash": "",
  "notes": "Pass-2 (GLM 5.3) audit of sys/dev/drm/drm_plane_helper.c. Rest of the file verified clean: src/dst rect math pre-validated by drm_framebuffer_check_src_coords (drm_framebuffer.c) + crtc-coord checks in __setplane_check (drm_plane.c:600-639) on every UAPI entry (legacy setplane, __setplane_atomic, universal cursor); drm_rect_calc_hscale/vscale guard dst==0 (drm_rect.c:129-130,198-201) and negatives (drm_rect.c:126-127); check_update has no in-tree callers besides drm_primary_helper_update (grep-verified); prepare_fb/cleanup_fb balanced by state-object identity around the swap at drm_plane_helper.c:374 (prepare when new_state->fb!=old_fb at :366-371, cleanup at :420-421 guarded by the same condition evaluated post-swap at :400); vblank get/put balanced at :411-415; disable path returns -EINVAL (:311-315) with __setplane_internal fb refcounting balanced (drm_plane.c:659-674). The open drm_atomic_uapi.c:307-316 lead was REFUTED - see findings/poc/neg-evidence-planehelper-sdhcipci-pass2/atomic_lead_refutation.md.",
  "recommended_fix": "Replace BUG_ON(num_connectors == 0) at drm_plane_helper.c:265 with a DRM_DEBUG_KMS + -EINVAL return",
  "fix_status": "not_applicable",
  "fix_baseline_reproduced": 0,
  "fix_patched_reproduced": 0,
  "fix_verdict": "not_applicable: no reproduction baseline exists (guest has no DRM hardware); the one-line BUG_ON->EINVAL change is trivially safe and cannot regress correctness since the surrounding code already returns -EINVAL for other invalid primary-plane states",
  "fix_evidence": "fix.diff"
}