{
  "finding_id": "DF-5028",
  "status": "not_reproduced",
  "reproduced": false,
  "impact": "none",
  "confidence": "likely",
  "verdict": "dce6_audio_get_pin() (sys/dev/drm/radeon/dce6_afmt.c:104-105) dereferences dig->pin after dig = radeon_encoder->enc_priv without a NULL check for every encoder that radeon_encoder_is_digital() accepts; that predicate (radeon_encoders.c:423-445) tests only encoder_id, while radeon_add_atom_encoder() assigns enc_priv from radeon_atombios_get_lvds_info() (returns NULL when the VBIOS LVDS_Info table is missing/unparsable or kzalloc fails - radeon_atombios.c:1630-1640) and from radeon_atombios_set_dig_info() (returns NULL on kzalloc failure - atombios_encoders.c:2760-2763) for exactly those digital ids. Reachable by default (radeon_audio=-1, radeon_drv.c:180; gate radeon_audio != 0, radeon_connectors.c:1766) on any display detect via radeon_audio_detect (radeon_connectors.c:1439/:1767) -> radeon_audio_get_pin (radeon_audio.c:425) -> dce6_audio_get_pin; the walk crashes on ANY digital encoder system-wide with NULL enc_priv, and the sibling unguarded derefs are radeon_audio.c:483 and radeon_audio.c:267. Impact ceiling is a kernel NULL-page read = panic (DoS), not a corruption primitive. Not reproduced at runtime because the audit guest has no AMD GPU (Bochs VGA 1234:1111, env.txt): dce6 code only executes on SI/CIK ASICs; source-level proof chain is deterministic, hence confidence likely, severity Low (hardware+firmware anomaly or OOM precondition).",
  "exploit_chain": "",
  "evidence": "VERDICT.md Proof chain (7 steps, each path:line); env.txt documents the guests display hardware (vgapci0 chip=0x11111234, Bochs std VGA) and stock X86_64_GENERIC lacking radeon hardware - the cited path cannot execute on this guest.",
  "kernel_refs": [
    "sys/dev/drm/radeon/dce6_afmt.c:104",
    "sys/dev/drm/radeon/radeon_encoders.c:423",
    "sys/dev/drm/radeon/atombios_encoders.c:2838",
    "sys/dev/drm/radeon/atombios_encoders.c:2757",
    "sys/dev/drm/radeon/radeon_atombios.c:1630",
    "sys/dev/drm/radeon/radeon_audio.c:483",
    "sys/dev/drm/radeon/radeon_connectors.c:1767"
  ],
  "poc_changes": "No runnable trigger possible on this guest (no AMD GPU; dce6_afmt executes only on DCE6+ ASICs). Verification was environment-level: confirmed the guest cannot execute the path; the finding stands on the deterministic source chain.",
  "attempts": 1,
  "guest_uname": "DragonFly dfbsd 6.5-DEVELOPMENT DragonFly 6.5-DEVELOPMENT #0: Thu Jul  2 06:02:54 UTC 2026     root@dfbsd:/usr/obj/usr/src/sys/X86_64_GENERIC  x86_64",
  "runtime_sec": 30,
  "guest_dirty": 0,
  "build_cmd": "",
  "run_cmd": "",
  "code_hash": "",
  "notes": "Same code exists verbatim in upstream Linux drivers/gpu/drm/radeon/dce6_afmt.c (no known CVE; trigger requires anomalous VBIOS or allocation failure). A third identical unguarded walk is in radeon_audio_enable() (radeon_audio.c:266-267) - same-family follow-up. Pass-2 negative results for the rest of dce6_afmt.c (SAD/ELD bounds, div0, pin-array bounds, endpoint reg locking) are recorded in VERDICT.md.",
  "recommended_fix": "NULL-check enc_priv before dereferencing dig->pin in dce6_audio_get_pin() (and the radeon_audio.c:483/:267 siblings): see fix.diff.",
  "fix_status": "not_testable",
  "fix_baseline_reproduced": 0,
  "fix_patched_reproduced": 0,
  "fix_verdict": "fix.diff adds the NULL guards (dce6_afmt.c:105, radeon_audio.c detect) but cannot be boot-validated on this guest: no AMD GPU means neither baseline nor patched kernel can execute the DCE6 audio path. Fix is trivially correct by inspection.",
  "fix_evidence": "fix.diff (applies cleanly to pristine sys/, patch --dry-run verified); no runtime validation possible - see env.txt."
}