{
  "finding_id": "DF-5069",
  "status": "untested",
  "verdict": "psm_fini_power_state_table() (sys/dev/drm/amd/powerplay/hwmgr/pp_psm.c:94-109) frees hwmgr->ps at :104 and NULLs request_ps/ps/current_ps (:105-107) but leaves hwmgr->boot_ps and hwmgr->uvd_ps - assigned as interior pointers of that array at pp_psm.c:79/:87, declared at inc/hwmgr.h:754-755 - dangling into freed memory. Grep across sys/dev/drm/amd shows no in-tree reader of hwmgr->boot_ps/hwmgr->uvd_ps (the si/ci/kv/amdgpu_pm boot_ps uses are the separate adev->pm.dpm.boot_ps field), so this is latent incomplete cleanup (CWE-459 shape), not a live UAF. Hardware-gated path (amdgpu attach) absent from the audit guest (QEMU std VGA, /dev/dri absent - env.txt), so no runtime verification is possible. Upstream-Linux cross-reference was attempted but web retrieval was unavailable during this run (firecrawl backend refused; kernel.org/elixir anti-bot gate; raw.github 429); finding argued on in-tree evidence only.",
  "reproduced": false,
  "impact": "none",
  "confidence": "certain",
  "exploit_chain": "",
  "evidence": "VERDICT.md (assignments :79/:87 vs fini :102-107, reader-grep proving latency); env.txt (hardware-absence documentation); fix.diff (NULL both pointers in fini).",
  "kernel_refs": ["sys/dev/drm/amd/powerplay/hwmgr/pp_psm.c:79", "sys/dev/drm/amd/powerplay/hwmgr/pp_psm.c:87", "sys/dev/drm/amd/powerplay/hwmgr/pp_psm.c:102", "sys/dev/drm/amd/powerplay/hwmgr/pp_psm.c:104", "sys/dev/drm/amd/powerplay/inc/hwmgr.h:754"],
  "poc_changes": "No PoC exists (latent hardening finding on a hardware-gated path). Evidence pack is analysis-only with hardware-absence documentation.",
  "attempts": 1,
  "guest_uname": "DragonFly dfbsd 6.5-DEVELOPMENT DragonFly 6.5-DEVELOPMENT #0: Thu Jul  2 06:02:54 UTC 2026\troot@dfbsd:/usr/obj/usr/src/sys/X86_64_GENERIC  x86_64",
  "runtime_sec": 60,
  "guest_dirty": 0,
  "build_cmd": "",
  "run_cmd": "",
  "code_hash": "dc30427e7f533edaced3576034e6d90a437036ebe66798ddc1c0f545c474807e",
  "notes": "code_hash is sha256 of fix.diff (no runnable PoC). Pure defense-in-depth: first future consumer of the published hwmgr->boot_ps/hwmgr->uvd_ps fields after a fini would UAF-read. Guest left clean and up.",
  "recommended_fix": "NULL hwmgr->boot_ps and hwmgr->uvd_ps in psm_fini_power_state_table() alongside request_ps/ps/current_ps (pp_psm.c:105).",
  "fix_status": "not_testable",
  "fix_baseline_reproduced": 0,
  "fix_patched_reproduced": 0,
  "fix_verdict": "Two-line NULLing fix, trivially correct by inspection; cannot be boot-validated on the audit guest (path requires an AMD GPU - env.txt).",
  "fix_evidence": "findings/poc/DF-5069/fix.diff; VERDICT.md fix section."
}