# VERDICT — DF-5069 (pass 2, df-bsd-reviewer)

Status: **untested** (hardware-gated — requires amdgpu attach; guest has no AMD
GPU, see env.txt). Defect existence: **certain** (dangling assignment is
objective). Impact today: **none** — latent hardening; no in-tree reader of the
dangling pointers exists.

## Where the defect is (path:line)

`sys/dev/drm/amd/powerplay/hwmgr/pp_psm.c`:

```c
 79: 			hwmgr->boot_ps = state;      /* state walks the hwmgr->ps array */
 87: 			hwmgr->uvd_ps = state;
...
102: 	kfree(hwmgr->current_ps);
103: 	kfree(hwmgr->request_ps);
104: 	kfree(hwmgr->ps);                       <- the array boot_ps/uvd_ps point into
105: 	hwmgr->request_ps = NULL;
106: 	hwmgr->ps = NULL;
107: 	hwmgr->current_ps = NULL;
```

`boot_ps` and `uvd_ps` are set as interior pointers of the `kcalloc(table_entries,
size)` allocation made at :53; after psm_fini they reference freed memory while
`ps`/`request_ps`/`current_ps` are properly NULLed. Fields are declared at
inc/hwmgr.h:754-755.

## Reachability analysis (why this is Info, not UAF)

grep over sys/dev/drm/amd for `boot_ps`/`uvd_ps`:
- only writers: pp_psm.c:79 and pp_psm.c:87 (into `struct pp_hwmgr`);
- the many other matches (si_dpm.c, ci_dpm.c, kv_dpm.c, amdgpu_pm.c,
  amdgpu_dpm.c/h) operate on `adev->pm.dpm.boot_ps` — a *different* field of the
  legacy dpm manager, never `hwmgr->boot_ps`.

So no current code dereferences the dangling pointers; the hazard materializes
only for future consumers of the (published, header-declared) fields. Classic
incomplete-cleanup / CWE-459 shape; fixing costs two lines. (Note: upstream Linux
cross-check was attempted but web fetch of the upstream file was unavailable during
this run — firecrawl backend refused, git.kernel.org/elixir under an anti-bot
gate, raw.githubusercontent 429 — so the finding is argued purely on in-tree
evidence.)

## Why untested on the guest

pp_psm functions run only after amdgpu attach; guest has no AMD display device
(pciconf chip=0x11111234 QEMU std VGA; /dev/dri absent; no drm attach in dmesg —
env.txt). No runtime trigger exists; a fix-validation kernel rebuild without the
hardware cannot demonstrate anything.

## Fix (fix.diff)

```diff
 	hwmgr->request_ps = NULL;
 	hwmgr->ps = NULL;
 	hwmgr->current_ps = NULL;
+	hwmgr->boot_ps = NULL;
+	hwmgr->uvd_ps = NULL;
 	return 0;
```

## Fix status (batch validation)
Applied with the 36 sibling fix.diffs of this batch in findings/poc/_batch41/all_fixes.patch; single in-guest `make -j6 nativekernel KERNCONF=X86_64_GENERIC` completed RC=0 with zero errors under -Werror (full log: findings/poc/_batch41/fix_build8.log). Behavior A/B intentionally skipped for this Info-tier item.