{
  "finding_id": "DF-5078",
  "file": "sys/dev/drm/amd/display/dc/irq/dce120/irq_service_dce120.c",
  "title": "irq_source_info_dce120[] leaves DC_IRQ_SOURCE_DC{1..6}_VLINE0 (enum 84..89) zero-initialized with .funcs==NULL; dal_irq_service_set/ack dereference info->funcs unguarded — DF-2168/DF-4932/DF-4995/DF-5054 family instance on the DCE120 table",
  "verdict": "reproduced (logic-level replica, family standard): 6 NULL-funcs slots 84..89; ack(84) signal 11; set(84) SIGSEGV exit=139 x2; fixed exit=0; amdgpu.ko fix build rc=0 0/0 -Werror",
  "impact": "panic (latent: no in-tree caller passes 84..89; no AMD GPU on guest)",
  "reproduce": {
    "build": "sh /root/df5078/build.sh",
    "run": "sh /root/df5078/run.sh",
    "expected": "baseline: NULL-funcs 84..89 + controls pass + exit=139 (SIGSEGV at info->funcs deref, irq_service.c:152/:118); fixed: exit=0"
  },
  "kernel_refs": ["sys/dev/drm/amd/display/dc/irq/dce120/irq_service_dce120.c:177", "sys/dev/drm/amd/display/dc/irq/irq_service.c:82", "sys/dev/drm/amd/display/dc/irq/irq_service.c:152", "sys/dev/drm/amd/display/dc/irq_types.h:140"],
  "artifacts": ["dce120_vline0gap.c", "build.sh", "run.sh", "build.log", "run.log", "run.2.log", "dmesg.txt", "fix.diff", "amdgpu_module_build.log", "fix_build.log", "fix_run.log", "env.txt", "VERDICT.md", "README.md", "verdict.json", "manifest.json"]
}