DF-4826 — amdgpu_acp.c is a dead translation unit on DragonFly

Claim

sys/dev/drm/amd/amdgpu/amdgpu_acp.c is never compiled into the DragonFly kernel or the amdgpu.ko module, and cannot be compiled as-shipped. Every code path in it — including the four open pass-1 findings DF-1907, DF-1908, DF-1909, DF-1910 — is unreachable at runtime on a DragonFly system.

Build

Nothing to build (that is the finding):

sh build.sh            # include-resolution gate; any C compiler dies on
                       # <linux/pm_domain.h>, which does not exist in
                       # sys/dev/drm/include/

Run

sh run.sh              # deterministic tree checks + recorded guest artifact check

Expected output (all five verdict inputs)

1. amdgpu_acp.c appears in no SRCS line of sys/dev/drm/amd/amdgpu/Makefile (the only "acp" hit is amdgpu_acpi.c, a different file — line 168).
2. sys/dev/drm/include/linux/pm_domain.h does not exist (only pm.h, pm_qos.h, pm_runtime.h); the entire sys/dev/drm/include/sound/ directory does not exist, so <sound/designware_i2s.h> and <sound/pcm.h> (amdgpu_acp.c:29-30) are fatal include errors.
3. CONFIG_DRM_AMD_ACP is never defined anywhere in sys/ — its only occurrences are #ifdef/#if defined consumers (amdgpu.h:823, vi.c:74/1685/1706, smu8_hwmgr.c:667), so adev->acp, the acp_ip_block registration in vi.c, and the smu8 ACP hwmgr path are all compiled out.
4. No mfd_add_hotplug_devices / mfd_add_devices / mfd_remove_devices / pm_genpd_init / pm_genpd_add_device / bus_find_device_by_name implementation exists anywhere in sys/ — the DFly mfd/genpd "shims" are include-guard-only headers (mfd/core.h defines nothing; struct platform_device is an empty struct).
5. Guest binary artifact: /boot/kernel/amdgpu.ko contains zero amdgpu ACP symbols (acp_ip_block, acp_hw_init, acp_poweron, …) while the acpi positive control matches 17.

Files

• check_dead.sh — deterministic tree + membership checks (the PoC source)
• build.sh / run.sh — exact commands
• run.log — full untrimmed output of the decisive run (host + guest)
• env.txt — host git rev, guest uname
• VERDICT.md — full narrative
• manifest.json / verdict.json

No fix.diff: this is a reachability refutation, not a memory-corruption finding; there is no kernel defect introduced by this file on DragonFly (because the file is not in the kernel). Recommended triage action lives in verdict.json recommended_fix.

DF-4826 VERDICT — dead translation unit; DF-1907/08/09/10 unreachable

Status: reproduced (the dead-code claim), impact: none, confidence: certain.

What was claimed (pass-2 reachability question)

The pass-2 task for sys/dev/drm/amd/amdgpu/amdgpu_acp.c was to determine which of the known findings (DF-1907 pp_funcs NULL deref in acp_poweron; DF-1908 dev_info(NULL,...) in get_mfd_cell_dev; DF-1909 genpd dangling in a global list after acp_hw_fini; DF-1910 i2s_pdata leak) are actually reachable given the state of the DragonFly linux-compat shims.

Answer: none of them — the translation unit is never built

Five independent proofs, all reproduced in run.log:

1. Not in the build. sys/dev/drm/amd/amdgpu/Makefile (67 SRCS lines, explicit lists, no wildcards) never mentions amdgpu_acp.c. The only grep hit for "amdgpu_acp" is amdgpu_acpi.c (line 168) — a different file whose presence is the positive control.
2. Cannot compile even if added. amdgpu_acp.c:27 includes <linux/pm_domain.h> and :29-30 include <sound/designware_i2s.h> / <sound/pcm.h>. None of these headers exist: sys/dev/drm/include/linux/ contains only pm.h, pm_qos.h, pm_runtime.h, and the sys/dev/drm/include/sound/ directory does not exist at all. Any compile attempt dies at line 27.
3. Config gate never opens. CONFIG_DRM_AMD_ACP is only ever consumed (#ifdef at amdgpu.h:823 guarding struct amdgpu_device::acp; #if defined at vi.c:74, vi.c:1685, vi.c:1706 guarding the acp_ip_block IP-block registration on CZ/Stoney; smu8_hwmgr.c:667) and never defined anywhere in the tree. Without it, adev->acp does not even exist as a struct member, so no caller-side path can reach ACP state either.
4. The shims the code depends on do not exist. DFly has no mfd and no genpd implementation: sys/dev/drm/include/linux/mfd/core.h is an empty include-guard; struct platform_device is an empty struct (platform_device.h:36-37); mfd_add_hotplug_devices, mfd_remove_devices, pm_genpd_init, pm_genpd_add_device, pm_genpd_remove_device, bus_find_device_by_name, struct generic_pm_domain, struct mfd_cell, struct i2s_platform_data appear in exactly one file of the whole sys/ tree: amdgpu_acp.c itself. There is no platform_bus_type, no cell device creation, no pdata probe callback that could re-enter this file.
5. The shipped binary agrees. On the audit guest (DragonFly v6.5.0.1712.g89e6a-DEVELOPMENT), nm /boot/kernel/amdgpu.ko | grep -cE 'acp_ip_block|acp_hw_init|acp_poweron' → 0, while the acpi control (grep -ci acpi) → 17. The module that ships with the OS contains no ACP code.

Consequence for the known findings (do not re-file; re-triage)

• DF-1907 (acp_poweron pp_funcs NULL deref, amdgpu_acp.c:159): latent in vendored source only. Runtime trigger requires acp_ip_block to be registered, which requires CONFIG_DRM_AMD_ACP, which is never defined.
• DF-1908 (dev_info(dev,...) with dev==NULL, amdgpu_acp.c:173): latent only; additionally bus_find_device_by_name/platform_bus_type have no implementation in this tree, so even a compiled-in file would fail at link time.
• DF-1909 (genpd left in global list / freed in acp_hw_fini, amdgpu_acp.c:228/463): latent only; pm_genpd_init has no DFly implementation and no global genpd list exists.
• DF-1910 (i2s_pdata leak, amdgpu_acp.c:242): latent only.

All four remain valid upstream Linux/vendored-source observations worth carrying in future drm syncs (upstream Linux reworked this file heavily after 4.x), but none is reachable on DragonFly as shipped.

Latent shapes analyzed in pass 2 and killed by the same dead-TU fact

For the record (these are additional latent defects found this pass; all unreachable for the same reason, so not filed separately):

• Error-path lifetime: acp_hw_init calls pm_genpd_init at :228 before the kcallocs at :230/:236/:242; a later allocation failure returns -ENOMEM leaving acp_genpd initialized, and :238/:245 kfree acp_res/acp_cell while the pointers stay dangling in adev->acp. The subsequent acp_hw_fini would then walk adev->acp.acp_cell[i].name at :454 → NULL/UAF read. Requires kcalloc failure on dead code — not reachable.
• Timeout paths leak state: the -ETIMEDOUT returns at :369/:385 (and fini's :431/:447) skip mfd_remove_devices/genpd teardown; recovery depends on the IP-fin callback running. Dead code — not reachable.
• The register-wait loops are bounded (0xFF iterations × udelay(100) ≈ 25.5 ms per loop, amdgpu_acp.c:361-372, 378-389, 423-434, 440-451) — the "infinite wait" hypothesis is killed: they are not infinite.
• Cell/resource bookkeeping is in-bounds: ACP_DEVS=4 cells over a 4-entry kcalloc, 5 resources over a 5-entry kcalloc, num_resources 5/1/1/1 consistent with the resource array — no OOB shape exists (amdgpu_acp.c:230-338).
• No firmware path, no audio-component interplay exists in this file (no component_add, no audio-component registration).

Fix

No kernel fix required — the code is not built. Triage action: mark DF-1907/DF-1908/DF-1909/DF-1910 deferred/latent (dead code on DFly) and carry the notes into the next drm vendor sync; optionally delete the file locally to prevent confusion (vendored-tree hygiene, not security).

Fix status (batch validation)

Applied with the 36 sibling fix.diffs of this batch in findings/poc/_batch41/all_fixes.patch; single in-guest make -j6 nativekernel KERNCONF=X86_64_GENERIC completed RC=0 with zero errors under -Werror (full log: findings/poc/_batch41/fix_build8.log). Behavior A/B intentionally skipped for this Info-tier item.

(No fix.diff for this item: documented recommendation only - see Fix above.)