# DF-5206 VERDICT — UNTESTED (hardware-absent; Info-class, Phase V exempt)

**Status: untested. Reproduced: no. Impact: none (code-shape defect is certain;
runtime consequence requires Trinity hardware to demonstrate).**

## What is certain (static proof)

1. `sys/dev/drm/radeon/trinity_smc.c:112` — `void trinity_acquire_mutex(...)`.
   A void return means a failed SMC-mutex acquisition is structurally
   unreportable: no caller can ever know the grant timed out.
2. `trinity_smc.c:117-121` — the grant poll runs at most `rdev->usec_timeout`
   iterations (100 ms, `RADEON_MAX_USEC_TIMEOUT`, radeon.h:131); on exhaustion
   the function silently returns at :122 with the mutex ungranted and the
   request line left asserted.
3. All six live call sites (`trinity_dpm.c:1099,1109,1138,1158,1258,1288`)
   proceed to program SMC registers immediately after the call, assuming
   exclusivity against the SMC firmware. The one remaining reference (:1300)
   is inside `#if 0` dead code.
4. The kernel-side indirect-access race class (DF-2135) was checked and is NOT
   present on Trinity: `tn_smc_rreg/tn_smc_wreg` (`sys/dev/drm/radeon/ni.c:41-58`)
   hold `rdev->smc_idx_lock` for the TN_SMC_IND_INDEX/DATA pairs. What
   `trinity_acquire_mutex` arbitrates is host-vs-SMC-firmware serialization,
   which that lock does not cover — so the gap is real, not a duplicate of
   DF-2135/DF-2130.

## Why not guest-verified

- Reachable only on AMD Trinity (HD 7xxx APU) ASICs; requires an SMC firmware
  that refuses/never grants the mutex (busy or wedged). The QEMU audit guest
  has no radeon GPU; no ioctl/sysctl/other software path reaches these
  functions — they run at DPM init/enable/disable/set-power-state from the
  driver's PM core.
- Info severity / no attacker-controlled input → outside the Phase V mandate
  (Critical/High, memcorrupt/privesc/hammer2 buckets, or trivial local PoC).
- Therefore: no PoC authored, `attempts: 0`, `code_hash` hashes
  `analysis.txt`.

## Fix

`fix.diff` (3 files):
- `trinity_smc.c`: `int trinity_acquire_mutex()` — returns 0 on grant,
  `-ETIME` on timeout after de-asserting the request and logging;
- `trinity_dpm.h:131`: prototype updated;
- `trinity_dpm.c`: all six live call sites check the result and bail
  (void functions return, int functions return `-ETIME`).

`git apply --check` verified clean against the pristine tree; never applied to
`sys/`; not hardware-validated (`fix_status: not_testable`).

## Escalation assessment

None. No memory-safety primitive; the defect degrades hardware PM sequencing
only. No unprivileged input touches this path.

## Fix status (batch validation)
Applied with the 36 sibling fix.diffs of this batch in findings/poc/_batch41/all_fixes.patch; single in-guest `make -j6 nativekernel KERNCONF=X86_64_GENERIC` completed RC=0 with zero errors under -Werror (full log: findings/poc/_batch41/fix_build8.log). Behavior A/B intentionally skipped for this Info-tier item.