DF-4886 / trigger_sketch.c
/* * DF-4886 trigger sketch (NOT runnable โ no powerplay GPU on the audit guest). * * The bug: phm_start_thermal_controller() is the sole public phm_* wrapper in * hardwaremanager.c that omits PHM_FUNC_CHECK. To fire it you need a pp_hwmgr * whose hwmgr_func is NULL and pm_en true โ no in-tree chip path produces that * state today (see README.md "Why latent"), so this sketch models the minimal * kernel-side harness that WOULD panic if that state ever existed: * * struct pp_hwmgr hwmgr = { .pm_en = true, .hwmgr_func = NULL }; * phm_start_thermal_controller(&hwmgr); * -> hardwaremanager.c:240 reads hwmgr.hwmgr_func->get_thermal_temperature_range * at offset ~0x?? of NULL => kernel NULL-deref panic. * * Equivalent live precursor (already filed): hwmgr_hw_init's own unguarded * deref at hwmgr.c:216 (DF-1913) fires even earlier on the same state. * * Build/run: kernel-internal; no userspace trigger exists. Recorded as a * static latent finding โ verdict "untested", attempts 0. */ int df4886_unused_trigger_placeholder; |