{
  "finding_id": "DF-4844",
  "status": "untested",
  "reproduced": 0,
  "impact": "none",
  "confidence": "speculative",
  "verdict": "Not reproduced (single-window TOCTOU; would need GPU-timed fence completion racing ctx teardown - the audit guest has no GPU). Code analysis: drm_sched_entity_fini (sched_entity.c:279-284) checks then uses entity->dependency while drm_sched_entity_clear_dep (sched_entity.c:312-320) writes entity->dependency = NULL unsynchronized from fence-signaling context (amdgpu IRQ ithread / any completing thread). A signal in the check->use window passes NULL (or a refcount-expired stale pointer) to dma_fence_remove_callback, whose lockmgr(fence->lock) (linux_fence.c:327) then NULL-derefs or touches freed memory -> fatal panic / UAF read. Reachable in principle from an unprivileged amdgpu render-node context kill during a pending dependency; window is a few instructions, hence speculative. Upstream 5.4-era shape is identical.",
  "exploit_chain": "",
  "evidence": "README.md (check-then-use vs unsynchronized cb write, with path:line and fix sketch)",
  "kernel_refs": [
    "sys/dev/drm/scheduler/sched_entity.c:279",
    "sys/dev/drm/scheduler/sched_entity.c:312",
    "sys/dev/drm/linux_fence.c:327"
  ],
  "poc_changes": "no runnable PoC (speculative race)",
  "attempts": 0,
  "guest_uname": "DragonFly dfbsd 6.5-DEVELOPMENT DragonFly 6.5-DEVELOPMENT #0: Thu Jul  2 06:02:54 UTC 2026     root@dfbsd:/usr/obj/usr/src/sys/X86_64_GENERIC  x86_64",
  "runtime_sec": 0,
  "guest_dirty": 0,
  "build_cmd": "",
  "run_cmd": "",
  "code_hash": "",
  "notes": "Distinct from DF-1927 (actor is a fence signaler, not the unparked scheduler thread; sink is the dependency cleanup, not the spsc queue). fix.diff omitted per policy for untested speculative findings; suggested fix in README.md (xchg the field before use).",
  "recommended_fix": "exchange entity->dependency with xchg() before the remove_callback/put pair in drm_sched_entity_fini so the callbacks NULL write cannot strand NULL/stale pointers in the cleanup"
}