{
  "finding_id": "DF-4914",
  "verdict": "reproduced",
  "impact": "panic",
  "reproduce": {
    "build": "cd /root/rfb && make",
    "run": "kldload drm; kldload radeon; kldload ./rfbuaf.ko; sysctl hw.rfbuaf=1|2|3 (2 and 3 on separate boots)",
    "expected": "stage1: 'rdev->mode_info.rfbdev = <ptr> — kfree()d block still recorded (dangling)'; stage2: panic 'memory chunk ... is already free!' stack chunk_mark_free<-_kfree<-radeon_fbdev_fini+0x78; stage3: 'RECLAIMED' + Fatal trap 9 GPF at radeonfb_destroy_pinned_object+0x1c"
  },
  "kernel_refs": [
    "sys/dev/drm/radeon/radeon_fb.c:379",
    "sys/dev/drm/radeon/radeon_fb.c:405",
    "sys/dev/drm/radeon/radeon_fb.c:415",
    "sys/dev/drm/radeon/radeon_display.c:1640"
  ],
  "artifacts": ["rfbuaf.c", "Makefile", "build.sh", "run.sh", "run.log", "console.log", "panic-stage2.txt", "panic-stage3.txt", "env.txt", "fix_build.log", "VERDICT.md", "fix.diff", "verdict.json", "manifest.json"]
}