{
  "finding_id": "DF-5745",
  "title": "apple_gmux: second-instance attach error path NULLs the shared global softc pointer while the first instance's vga_switcheroo handler stays registered -> NULL-deref panic in gmux_switchto",
  "verdict": "reproduced",
  "impact": "panic",
  "reproduce": {
    "build": "guest: cd /root/gmuxtrig_b && make; host: python3 make_ssdt.py ssdt_b.aml AAA0=8e AAA2=4cc",
    "run": "boot with QEMU_EXTRA='-acpitable file=ssdt_b.aml'; kldload apple_gmux; kldload gmuxtrig.ko",
    "expected": "apple_gmux1 attach returned -22; then Fatal trap 12, fault va 0x60, Stopped at gmux_switchto+0x10: movl %edi,0x60(%rbx)"
  },
  "kernel_refs": ["sys/gnu/dev/misc/apple_gmux/apple-gmux.c:130", "sys/gnu/dev/misc/apple_gmux/apple-gmux.c:511", "sys/gnu/dev/misc/apple_gmux/apple-gmux.c:867", "sys/gnu/dev/misc/apple_gmux/apple-gmux.c:894", "sys/dev/video/vga/vga_switcheroo.c:242", "sys/dev/drm/i915/i915_drv.c:742"],
  "artifacts": ["README.md", "VERDICT.md", "make_ssdt.py", "ssdt_b.aml", "ssdt_b2.aml", "gmuxtrig.c", "Makefile", "build.sh", "run.sh", "build.log", "run.log", "panic.txt", "panic.b2.txt", "fix.diff", "fix_validation.log", "env.txt", "manifest.json", "verdict.json"]
}