{
  "finding_id": "DF-4892",
  "status": "untested",
  "reproduced": 0,
  "impact": "none",
  "confidence": "certain",
  "verdict": "DF-4761 twin confirmed by inspection: smu7_thermal.c:100 and :273 compute 60*crystal_clock_freq*10000 in u32; vi_get_xclk() returns 25/27 MHz-class reference_freq for SMU7 parts, so the product wraps (1.5e10 -> 2115098112) before the division, skewing both the hwmon-reported fan RPM and the programmed TACH TARGET_PERIOD by a constant ~7.09x. Info severity: telemetry/hw-reliability only (write path root-only), no memory safety. Kernel-path PoC not executed: the QEMU guest has no AMD GPU (no SMU7 fan controller), and Info findings are skipped per contract; arithmetic divergence demonstrated by the userspace demo (run.log) evaluating the exact source expressions in u32 vs u64.",
  "exploit_chain": "",
  "evidence": "run.log: xclk=25000 u32: 2115098112 u64: 15000000000 wrap: YES + TARGET_PERIOD off by 7.09x rows; smu7_thermal.c:100/:273; vi.c:326-349; smu7_hwmgr.c:5086-5087; amdgpu_pm.c:1204/1266/1297",
  "kernel_refs": [
    "sys/dev/drm/amd/powerplay/hwmgr/smu7_thermal.c:100",
    "sys/dev/drm/amd/powerplay/hwmgr/smu7_thermal.c:273",
    "sys/dev/drm/amd/amdgpu/vi.c:326",
    "sys/dev/drm/amd/powerplay/hwmgr/smu7_hwmgr.c:5086",
    "sys/dev/drm/amd/amdgpu/amdgpu_pm.c:1297"
  ],
  "poc_changes": "wrote rpm_wrap_demo.c evaluating the exact kernel expressions in u32 vs u64 (userspace arithmetic demo; kernel path hardware-gated)",
  "attempts": 0,
  "guest_uname": "DragonFly dfbsd 6.5-DEVELOPMENT DragonFly 6.5-DEVELOPMENT #0: Thu Jul  2 06:02:54 UTC 2026 root@dfbsd:/usr/obj/usr/src/sys/X86_64_GENERIC x86_64",
  "runtime_sec": 20,
  "guest_dirty": 0,
  "build_cmd": "sh /root/df4892/build.sh",
  "run_cmd": "sh /root/df4892/run.sh",
  "code_hash": "74e6ee391a4a40a124e8c5ec693d9086b0b90bf404281b02ad8a312c27cc529b",
  "notes": "verification of kernel path skipped per contract (Info severity) and impossible on this guest (no AMD GPU); demo run on guest userspace documents the wrap. All other smu7_thermal.c candidates killed by inspection (see VERDICT.md).",
  "recommended_fix": "u64-cast the product before dividing at smu7_thermal.c:100 and :273: (uint64_t)60 * crystal_clock_freq * 10000 / ...",
  "fix_status": "not_testable",
  "fix_baseline_reproduced": 0,
  "fix_patched_reproduced": 0,
  "fix_verdict": "fix not built/validated: requires SMU7 hardware to exercise the fan-controller path; the one-line u64-cast fix is identical in shape to the DF-4761 fix and is arithmetically sufficient (demos u64 column = correct values)",
  "fix_evidence": "findings/poc/DF-4892/run.log u32 vs u64 columns"
}