{
  "finding_id": "DF-4994",
  "status": "untested",
  "attempts": 0,
  "reproduced": 0,
  "impact": "corruption",
  "confidence": "certain",
  "verdict": "Latent double-free/UAF (Low, hw-gated + status.sw-gated on this tree): vega10_smu_inits free_backend label kfrees hwmgr->smu_backend WITHOUT NULLing it - vega10_smu_finis only defense is if (priv) and a dangling non-NULL passes it, so any fini-after-failed-init re-kfrees the backend and runs amdgpu_bo_free_kernel on freed memory (the vega12 DF-4951 shape; the success-time fini has exactly the missing NULL at :316). On this tree the IP status.sw gating blocks it (a leak only); it goes live the moment any path calls sw_fini after a failed sw_init. One-line NULL fix.",
  "exploit_chain": "vega10 smu_init failure -> dangling backend -> later sw_fini -> double free / bo ops on freed memory",
  "evidence": "findings/poc/DF-4994/ (this verdict)",
  "kernel_refs": [
    "sys/dev/drm/amd/powerplay/smumgr/vega10_smumgr.c:288-291",
    "sys/dev/drm/amd/powerplay/smumgr/vega10_smumgr.c:298",
    "sys/dev/drm/amd/amdgpu/amdgpu_device.c:1637-1643"
  ],
  "guest_uname": "",
  "code_hash": ""
}