# DF-1065 — UVC buffer-queue use-after-free (`bq->mem` kfree'd while mmap'd)

## Verdict (this run)
**SOURCE-CONFIRMED, NOT REPRODUCED AT RUNTIME on this guest** — the bug is real
and traced line-by-line in compiled module source (`uvc.ko` ships in
`/boot/kernel`), but the UVC driver never attaches here because the guest has no
USB camera and `/dev/video*` does not exist. The fix (`fix.diff`) **applies and
compiles** (`uvc.ko` rebuilt clean under `-Werror`).

## How to reproduce (HW-equipped host)
1. `./build.sh && ./run.sh` — opens `/dev/video0`, acquires priority, REQBUFS(1),
   `mmap` + touch, then REQBUFS again (kfree old `bq->mem`); the mmap'd region
   now references freed kernel heap (info leak on read, corruption on write).
2. Requires: a UVC camera attached so `uvc.ko` loads and `/dev/video0` exists.
   `/dev/videoN` is created mode `0666` (`uvc_v4l2.c:784`), so any local user.

## Why not on this guest
No USB Video Class device is attached; `uvc.ko` is not loaded and there is no
`/dev/video*`. The trigger cannot even `open()` a device. This is the
"needs specific HW" case — the code path is dormant, not absent.

## Files
- `poc_uvc_uaf.c` — intended V4L2 REQBUFS-path trigger (documented).
- `fix.diff` — `mapped`-flag mitigation: pin the buffer while an mmap exists.
- `uvc_fix_build.log` — proof the fix compiles (`-Werror`, rc=0).
- `VERDICT.md` — full line-by-line trace.