{
  "finding_id": "DF-4912",
  "title": "Dead stats module carries a latent length==0 off-by-one OOB write in mod_stats_update_event (event_string[-1]); module not compiled by any Makefile",
  "verdict": "untested",
  "impact": "none (dead code; semantic off-by-one demonstrated in userspace clone)",
  "confidence": "certain",
  "reproduce": {
    "build": "cc -O2 -Wall -o stats_len0_demo stats_len0_demo.c",
    "run": "./run.sh",
    "expected": "gcc -Warray-bounds flags the [-1] subscript; demo prints 'PROVEN: write landed at event_string[-1] (offset 3, entry_id MSB)'"
  },
  "kernel_refs": [
    "sys/dev/drm/amd/display/modules/stats/stats.c:296-326",
    "sys/dev/drm/amd/amdgpu/Makefile:49-51"
  ],
  "artifacts": [
    "README.md", "VERDICT.md", "stats_len0_demo.c", "build.sh", "run.sh",
    "run.log", "env.txt", "fix.diff", "verdict.json", "manifest.json"
  ]
}