fix: complete hardware collection diagnostics

audit/internal/collector/dmesg_events.go

@@ -34,6 +34,20 @@ var dmesgErrorPatterns = []*regexp.Regexp{
 	regexp.MustCompile(`(?i)\bdisabled\b`),
 }
 
+// Boot-time messages below are noisy configuration/driver diagnostics, not
+// hardware incidents.  Raw dmesg remains in the bundle, but presenting each
+// of them as Critical makes the event log unusable.
+var dmesgIgnorePatterns = []*regexp.Regexp{
+	regexp.MustCompile(`(?i)bridge window .* failed to assign`),
+	regexp.MustCompile(`(?i)^NVRM: loading NVIDIA .* Kernel Module`),
+	regexp.MustCompile(`(?i)^NVRM: Persistence mode is deprecated`),
+	regexp.MustCompile(`(?i)^nvidia: module verification failed:.*tainting kernel`),
+	regexp.MustCompile(`(?i)^Yama: disabled by default`),
+	regexp.MustCompile(`(?i)^ERST: .*initialized`),
+	regexp.MustCompile(`(?i)iommu sva bind failed: -95`),
+	regexp.MustCompile(`(?i)gpuClearFbhubPoisonIntrForBug`),
+}
+
 // collectDmesgErrors runs `dmesg -T` (or `dmesg` without -T on failure) and
 // returns only lines that match known error/warning patterns.
 func collectDmesgErrors() []schema.HardwareEventLog {
@@ -77,6 +91,9 @@ func parseDmesgErrors(output string) []schema.HardwareEventLog {
 		if !matchesAny(message, dmesgErrorPatterns) {
 			continue
 		}
+		if matchesAny(message, dmesgIgnorePatterns) {
+			continue
+		}
 
 		severity := dmesgSeverity(message)
 		source := "dmesg"
@@ -114,10 +131,8 @@ func matchesAny(s string, patterns []*regexp.Regexp) bool {
 // "fault" (de-fault), and "undead" would contain "dead".
 var dmesgSeverityCriticalPatterns = []*regexp.Regexp{
 	regexp.MustCompile(`(?i)\bpanic\b`),
-	regexp.MustCompile(`(?i)\baer\b`),
 	regexp.MustCompile(`(?i)\buncorrect`),
 	regexp.MustCompile(`(?i)\bxid\b`),
-	regexp.MustCompile(`(?i)\bnvrm\b`),
 	regexp.MustCompile(`(?i)\berror\b`),
 	regexp.MustCompile(`(?i)\bfault\b`),
 	regexp.MustCompile(`(?i)\bfail(ed|ure)?\b`),