{
  "finding_id": "DF-5206",
  "status": "untested",
  "reproduced": false,
  "impact": "none",
  "confidence": "certain",
  "verdict": "Static fail-open proven at sys/dev/drm/radeon/trinity_smc.c:112-122: trinity_acquire_mutex() is void, polls the SMC firmware mutex grant (SMC_INT_REQ) for up to 100 ms, and on timeout silently returns without the mutex and with the failure unreportable by construction; all six live call sites in trinity_dpm.c (1099, 1109, 1138, 1158, 1258, 1288) then program SMC registers assuming exclusivity against the SMC firmware. Runtime demonstration requires Trinity hardware with a non-granting SMC — absent from the audit QEMU guest — and as an Info-class hardening finding with no attacker-controlled input it is outside the Phase V mandate, so no PoC was authored or run. The DF-2135/DF-2130 kernel-side idx-lock class was checked and is NOT present on Trinity (tn_smc_rreg/tn_smc_wreg hold smc_idx_lock, ni.c:41-58): this gap is host-vs-SMC-firmware serialization only.",
  "exploit_chain": "",
  "evidence": "analysis.txt (annotated walkthrough); fix.diff (3-file API change: int return + -ETIME, prototype, six live call sites; git apply --check clean); decisive lines trinity_smc.c:112 (void return), :117-121 (poll loop), :122 (silent fall-through); consumers trinity_dpm.c:1099,1109,1138,1158,1258,1288; register def trinityd.h:167; timeout radeon.h:131; negative check ni.c:41-58",
  "kernel_refs": ["sys/dev/drm/radeon/trinity_smc.c:112", "sys/dev/drm/radeon/trinity_smc.c:117", "sys/dev/drm/radeon/trinity_smc.c:122", "sys/dev/drm/radeon/trinity_dpm.c:1109", "sys/dev/drm/radeon/trinity_dpm.c:1258", "sys/dev/drm/radeon/trinityd.h:167", "sys/dev/drm/radeon/ni.c:41"],
  "poc_changes": "No PoC authored: only reachable on AMD Trinity ASICs through the radeon DPM core (init/enable/disable/set-power-state); the QEMU audit guest has no radeon GPU and there is no software-only trigger. Static proof + fix.diff shipped instead.",
  "attempts": 0,
  "guest_uname": "",
  "runtime_sec": 0,
  "guest_dirty": 0,
  "build_cmd": "",
  "run_cmd": "",
  "code_hash": "64259b65d4b78ec009e7afe403b7e2dbb639e00dc9fcdbf5a930ae2f2a75d63f",
  "notes": "Unique to Trinity in the radeon SMC family (si/ci/sumo/kv have no equivalent void mutex-grant wait; verified by rg over sys/dev/drm/radeon/). Reliability fail-open; no memory-safety primitive; the 7th reference (trinity_dpm.c:1300) is inside #if 0 dead code and intentionally left untouched by the fix.",
  "recommended_fix": "Make trinity_acquire_mutex() return int (0 on grant, -ETIME after de-asserting the request) and have every live caller bail out on failure (see fix.diff).",
  "fix_status": "not_testable",
  "fix_baseline_reproduced": 0,
  "fix_patched_reproduced": 0,
  "fix_verdict": "fix.diff authored against the read-only sys/ tree (trinity_smc.c + trinity_dpm.h + trinity_dpm.c, six live call sites updated) and verified with git apply --check. Cannot be hardware-validated: baseline cannot be reproduced without Trinity ASICs, so fix_status is not_testable rather than fixed.",
  "fix_evidence": "fix.diff in this directory; git apply --check clean against the pristine tree (verified during authoring); no kernel build attempted since runtime validation is impossible without TN hardware."
}