{
  "finding_id": "DF-5213",
  "status": "not_reproduced",
  "reproduced": 0,
  "impact": "none",
  "confidence": "certain",
  "verdict": "Latent-hazard Info finding, code facts certain, nothing manifests. df_v3_6_funcs (sys/dev/drm/amd/amdgpu/df_v3_6.c:108-116, selected for CHIP_VEGA20 at soc15.c:519-520; compiled per amdgpu/Makefile:80) initializes 6 of the 7 members of struct amdgpu_df_funcs (amdgpu.h:771-783), leaving .enable_ecc_force_par_wr_rmw NULL by designated-initializer rules. The sole call site (gmc_v9_0.c:759) is gated on asic_type == CHIP_VEGA10 (gmc_v9_0.c:753), which uses df_v1_7_funcs where the op IS implemented (df_v1_7.c:105,119) - exhaustive grep confirms no other caller - so the slot is never dispatched today; a widened asic gate or future Vega20 caller converts it into a boot-time NULL function-pointer dereference (panic). Inherited unchanged from upstream Linux. Guest runtime probe: no vendor-0x1002 PCI device at all (run.log: AMD_GREP_RC=1, VEGA20_GREP_RC=1, no drm/amd kmods) - nothing observable, hence not_reproduced/impact none. All other classes hunted in df_v3_6.c are killed with line cites in VERDICT.md, notably: the DF-2202 table-index OOB class does NOT carry over (4-bit field mask 0x3C>>2 max 15 vs 15-entry table PLUS an explicit >= ARRAY_SIZE clamp at df_v3_6.c:67-68, which df_v1_7 lacked); MGCG enum values fit the 0xF field mask; get_hbm_channel_number feeds only vram_width (no memory-safety sink).",
  "exploit_chain": "",
  "evidence": "run.log (guest /usr/src grep showing the 6-of-7 initializer, the sole VEGA10-gated call site, the df_v1_7 implementation, and the no-AMD-hardware probe); VERDICT.md (line-accurate trace + five negative-result classes); fix.diff (one-line NULL guard, patch -p1 --dry-run clean); trigger.sh (re-derives everything on any DF host)",
  "kernel_refs": [
    "sys/dev/drm/amd/amdgpu/df_v3_6.c:108-116",
    "sys/dev/drm/amd/amdgpu/amdgpu.h:771-783",
    "sys/dev/drm/amd/amdgpu/gmc_v9_0.c:753-759",
    "sys/dev/drm/amd/amdgpu/soc15.c:519-522",
    "sys/dev/drm/amd/amdgpu/df_v1_7.c:105-119"
  ],
  "poc_changes": "Authored fresh (no seed); trigger.sh is a source-trace + hardware-probe script because no userspace trigger exists for an init-path vtable gap.",
  "attempts": 1,
  "guest_uname": "DragonFly dfbsd 6.5-DEVELOPMENT DragonFly 6.5-DEVELOPMENT #0: Thu Jul  2 06:02:54 UTC 2026     root@dfbsd:/usr/obj/usr/src/sys/X86_64_GENERIC  x86_64",
  "runtime_sec": 60,
  "guest_dirty": 0,
  "build_cmd": "(nothing to build - no userspace trigger; sh trigger.sh is the probe)",
  "run_cmd": "sh trigger.sh",
  "code_hash": "b5fe76c2ac726a5d902450bffd5195d781cfa82a8d46157a089ed997f3241ed2",
  "notes": "df family pass-2 close-out: df_v1_7 audited clean-beyond-DF-2202 this pass; v3_6 sibling carries the DF-2202-class guard already (df_v3_6.c:67-68) - the only actionable item in the file is the incomplete vtable. Zero attacker-controlled input reaches this file (register R/W during GPU init only).",
  "recommended_fix": "NULL-guard the sole indirect call: if (adev->df_funcs->enable_ecc_force_par_wr_rmw) adev->df_funcs->enable_ecc_force_par_wr_rmw(adev, false); at gmc_v9_0.c:759 (see fix.diff).",
  "fix_status": "not_testable",
  "fix_baseline_reproduced": 0,
  "fix_patched_reproduced": 0,
  "fix_verdict": "No runtime behavior exists to A/B (slot never dispatched; guest has no AMD GPU). fix.diff is a pure NULL-guard on an existing expression, patch -p1 --dry-run clean against the pristine tree; full drm module build skipped as disproportionate for an Info-grade latent hazard.",
  "fix_evidence": "fix.diff; run.log (AMD_GREP_RC=1 / VEGA20_GREP_RC=1 hardware absence)"
}