{
  "finding_id": "DF-5132",
  "status": "untested",
  "reproduced": false,
  "impact": "none",
  "confidence": "certain",
  "verdict": "Statically certain logic defect, hardware-gated runtime: amdgpu_kv_notify_message_to_smu() (kv_smc.c:33-55) validates the SMC response by rejecting only 0xFF/0xFE, so a wait-loop timeout (resp 0x00 = no response yet per ppsmc.h:67 where OK==0x01) and every undefined 0x02-0xFD fall through to return 0 = success. The whole kv_dpm.c power-management state machine then proceeds against a wedged SMC (dpm enable/bapm/table uploads all believe they succeeded). No attacker-controlled input, no memory-safety consequence (the SMC SRAM write path fails closed - see VERDICT.md kill trace for the kv_smc.c:129 wrap), realistic ceiling is PM desynchronization/GPU hang on already-faulted hardware -> Info. Not runtime-reproducible: audit guest has zero AMD/ATI PCI devices and the trigger needs Kaveri-class APU silicon with a stalled SMC. Untested recorded honestly; mechanical static proof (5 assertions incl. the ci_smc.c:187 contrast where the sibling DOES surface timeouts) in check_static.log.",
  "exploit_chain": "",
  "evidence": "check_static.log: PASS kv_smc.c:47-54 ... return 0 reachable with tmp==0x00 plus the PPSMC_Result_OK==0x01, wait-loop, and ci-contrast PASSes; fix.diff hunk @@ -44,11 +44,10 @@ replacing the nested 0xFF/0xFE ifs with tmp != PPSMC_Result_OK rejection; VERDICT.md records the fail-closed kill of the adjacent kv_smc.c:129 u32-wrap candidate (inner kv_set_smc_sram_address re-validation at :83, non-wrappable due to the :81 4-alignment gate)",
  "kernel_refs": [
    "sys/dev/drm/amd/amdgpu/kv_smc.c:33-55",
    "sys/dev/drm/amd/amdgpu/kv_smc.c:47-54",
    "sys/dev/drm/amd/amdgpu/ppsmc.h:67-68",
    "sys/dev/drm/amd/amdgpu/ci_smc.c:170-187"
  ],
  "poc_changes": "no seed PoC existed (filed during pass 2 with untested verdict); authored check_static.sh (5 mechanical assertions against the tree) since no runtime trigger is possible without Kaveri APU hardware",
  "attempts": 1,
  "guest_uname": "DragonFly dfbsd 6.5-DEVELOPMENT DragonFly 6.5-DEVELOPMENT #0: Thu Jul  2 06:02:54 UTC 2026 root@dfbsd:/usr/obj/usr/src/sys/X86_64_GENERIC x86_64 (guest up, zero AMD/ATI PCI devices)",
  "runtime_sec": 2,
  "guest_dirty": 0,
  "build_cmd": "none (static): sh findings/poc/DF-5132/check_static.sh /home/maxx/dfbsd/dfbsd",
  "run_cmd": "sh findings/poc/DF-5132/check_static.sh /home/maxx/dfbsd/dfbsd",
  "code_hash": "e831f1b2f3c77c9b482cb214ff5f0013b8f60691b25992e5c89820aa83049bca",
  "notes": "Independent of known DF-2130 (missing smc_idx_lock) - this is the response validator, not the register-access serialization. radeon/kv_smc.c:30-52 is byte-identical and carries the same fall-through (twin-file candidate, that files pass-1/pass-2 rows are clean). Killed adjacent candidate this pass: kv_smc.c:129 (smc_start_address+byte_count) u32 wrap passes the outer limit check but every inner kv_set_smc_sram_address (:139/:178/:193/:211) re-validates (smc_address+3)>limit at :83 where wrap is impossible because the :81 gate forces 4-aligned addresses <= 0xFFFFFFFC -> whole copy fails closed; NOT the amdgpu twin of DF-2105 despite surface similarity.",
  "recommended_fix": "Reject every response != PPSMC_Result_OK (return -EINVAL with a dev_err identifying the message and response) instead of whitelisting only 0xFF/0xFE; mirror in radeon/kv_smc.c - see fix.diff",
  "fix_status": "not_applicable",
  "fix_baseline_reproduced": 0,
  "fix_patched_reproduced": 0,
  "fix_verdict": "fix validation not applicable: no runtime baseline can exist on the QEMU audit guest (no AMD GPU) and the defect requires a stalled Kaveri SMC to manifest; fix.diff verified to apply cleanly (git apply --check) to the unmodified tree and uses PPSMC_Result_OK which is already in scope via kv_dpm.h:31 -> ppsmc.h",
  "fix_evidence": "git apply --check findings/poc/DF-5132/fix.diff => clean; hunk @@ -44,11 +44,10 @@ sys/dev/drm/amd/amdgpu/kv_smc.c"
}