[BUG] amdgpu PRT/sparse texture crashes on Polaris (RX 590) — 3 bugs from refactor 0fdf257286d7

# [BUG] amdgpu PRT/sparse texture crashes on Polaris (RX 590) — kernel 7.x regression from refactor `0fdf257286d7`

## Hardware
- GPU: AMD Radeon RX 590 (Polaris, 1002:67DF, rev C7)
- CPU: AMD Ryzen 5 3600
- RAM: 7.7 GB
- Motherboard: B450 (PCIe 3.0)

## Software
- Distribution: CachyOS (fully updated)
- Kernel: `linux-cachyos` 7.1.3-1, 7.1.3-2 (confirmed broken)
- Kernel (working): `linux-cachyos-lts` 6.18.38-2 (no crashes)
- Desktop: KDE Plasma (Wayland)
- amdgpu params: `amdgpu.runpm=0 amdgpu.gpu_recovery=1 amdgpu.vm_fault_stop=0 amdgpu.noretry=1`

## Symptoms

Three distinct crash modes, all from the same root cause:

### 1. CS2 segfault + GPU hang
Counter-Strike 2 crashes with GPU hang after ~1-2h gameplay. Kernel logs show:
```
amdgpu: Disabling VM faults because of PRT request!
```
followed by GPU recovery attempt that fails, then system freeze. Observed across **27 CS2 sessions** with multiple hard-lockup freezes requiring power button reset.

### 2. Sunshine VAAPI crash
VAAPI-accelerated Sunshine streaming crashes with GPU recovery loop. Same PRT-disabling pattern in dmesg.

### 3. Silent system freeze (no panic, no recovery)
With `nowatchdog` in kernel params, softlockup watchdog is disabled. When GPU hangs and recovery fails (due to CVE-2025-40339 null pointer), the system freezes silently — no panic, no crash log, no disk activity. Monitor logs detect these as `CRASH: el boot anterior fue interrumpido (apagon forzado / freeze sin recovery)`.

**26 forced reboots recorded** between Jun 22 and Jul 17, 2026.

## Root Cause

Upstream refactor commit `0fdf257286d7` (Jun 2025, "drm/amdgpu: change mappings to store UAPIs flags") changed VM mappings to store UAPI flags instead of HW PTE flags. This introduced **three downstream bugs** in the PRT (Page Retirement Table / sparse texture) path:

### Bug 1: Wrong flag check in `amdgpu_vm_bo_clear_mappings`
- **File**: `drivers/gpu/drm/amd/amdgpu/amdgpu_vm.c`
- **Problem**: `amdgpu_vm_bo_clear_mappings` checks `AMDGPU_PTE_PRT_FLAG(adev)` (HW PTE flag), but after the refactor, mappings store `AMDGPU_VM_PAGE_PRT` (UAPI flag)
- **Result**: PRT entries are never properly cleared → corrupted page tables → GPU page faults → hang
- **Fix**: Timur Kristóf patch to amd-gfx mailing list (Nov 2025, reviewed by Christian König) — check `AMDGPU_VM_PAGE_PRT` instead
- **Link**: https://lists.freedesktop.org/archives/amd-gfx/2025-November/134199.html
- **Status**: Never merged upstream

### Bug 2: Null pointer dereference in `amdgpu_vm_handle_moved` (CVE-2025-40339)
- **File**: `drivers/gpu/drm/amd/amdgpu/amdgpu_amdkfd_gpuvm.c`
- **Problem**: `fpriv->prt_va->bo` can be NULL when GPU recovery triggers PRT cleanup
- **Result**: When Bug 1 corrupts page tables and recovery runs, it hits this null pointer → recovery fails → system freezes
- **Fix**: Heng Zhou patch (Aug 2025), commit `859958a7faefe5b7742b7b8cdbc170713d4bf158`
- **Status**: Merged in 6.12.58+ and 6.17.8+ — not in CachyOS 7.x (based on 7.x branch without these fixes)

### Bug 3: Missing NULL guard in `amdgpu_gem_va_update_vm`
- **File**: `drivers/gpu/drm/amd/amdgpu/amdgpu_gem.c`
- **Problem**: No NULL check on `bo_va->base.bo` before use
- **Fix**: Srinivasan patch proposed to amd-gfx (Mar 2026)
- **Link**: https://lists.freedesktop.org/archives/amd-gfx/2026-March/141598.html
- **Status**: Never merged (Christian König identified flaw in approach)

## Crash chain
```
PRT texture page (CS2/Sunshine)
→ refactor 0fdf257286d7 misroutes flag check
→ amdgpu_vm_bo_clear_mappings doesn't clear PRT entries (Bug 1)
→ GPU page table corruption → GPU hang
→ gpu_recovery=1 tries recovery
→ amdgpu_vm_handle_moved hits NULL prt_va->bo → CVE-2025-40339 (Bug 2)
→ recovery fails → GPU still hung
→ nowatchdog → no softlockup panic → SILENT FREEZE
```

## Workaround

Switch to `linux-cachyos-lts` (currently 6.18.38-2), which predates the refactor `0fdf257286d7` and works reliably.

## Request

Please apply the following patches to the `linux-cachyos` 7.x kernel branch:

1. **Timur Kristóf fix** for `amdgpu_vm_bo_clear_mappings` (PRT flag check)
2. **Heng Zhou fix** (commit `859958a7faefe5b7742b7b8cdbc170713d4bf158`) for CVE-2025-40339
3. A proper fix for the NULL guard in `amdgpu_gem_va_update_vm`

Alternatively, carry these as CachyOS-specific kernel patches in `kernel-patches/` until upstream merges proper fixes.

## Verification

- CachyOS 7.1.3-1/7.1.3-2 source confirmed vulnerable for all 3 bugs
- LTS kernel 6.18.38-2 confirmed working (0 crashes in 24h+ of testing, including CS2 sessions)
- Full diagnostic data: `/home/danivar/Extra/monitor-logs/` (system monitor logs, 27 CS2 session analyses, kernel error logs)

## References

- Refactor commit: `0fdf257286d7` ("drm/amdgpu: change mappings to store UAPIs flags")
- Fix for Bug 1: https://lists.freedesktop.org/archives/amd-gfx/2025-November/134199.html
- CVE-2025-40339 (Bug 2): commit `859958a7faefe5b7742b7b8cdbc170713d4bf158`
- Fix for Bug 3 (unmerged): https://lists.freedesktop.org/archives/amd-gfx/2026-March/141598.html

Start by comparing the 7.x versions of drivers/gpu/drm/amd/amdgpu/amdgpu_vm.c, amdgpu_amdkfd_gpuvm.c, and amdgpu_gem.c with the referenced refactor and fixes. Review the Timur Kristóf, Heng Zhou, and Srinivasan patch references, then validate the resulting kernel on the RX 590 with PRT workloads such as CS2 or Sunshine. Done means the fixes are carried in the 7.x branch and the reported GPU hangs and recovery failures no longer reproduce.

Written by the indexing model from the issue text.