{
  "finding_id": "DF-4975",
  "verdict": "verified-by-trace (untested on guest: no AMD GPU / SR-IOV hardware)",
  "impact": "host-timed guest kernel panic (NULL func call via zeroed work_struct)",
  "reproduce": {
    "build": "n/a — requires Vega20-class SR-IOV VF guest with PF-controlled mailbox",
    "run": "n/a — PF sends IDH_FLR_NOTIFICATION into the amdgpu_irq_get(rcv) -> INIT_WORK window at driver probe or resume",
    "expected": "workqueue worker calls work->func == NULL -> kernel panic in process_all_work (sys/dev/drm/linux_workqueue.c:89)"
  },
  "kernel_refs": [
    "sys/dev/drm/amd/amdgpu/mxgpu_ai.c:351",
    "sys/dev/drm/amd/amdgpu/mxgpu_ai.c:360",
    "sys/dev/drm/amd/amdgpu/mxgpu_ai.c:287-310",
    "sys/dev/drm/amd/amdgpu/amdgpu_virt.c:282",
    "sys/dev/drm/amd/amdgpu/amdgpu_device.c:1696",
    "sys/dev/drm/amd/amdgpu/amdgpu_device.c:2700",
    "sys/dev/drm/linux_workqueue.c:89"
  ],
  "artifacts": ["README.md", "VERDICT.md", "fix.diff", "verdict.json", "manifest.json", "env.txt"]
}