# DF-1218 - Verification Verdict

**Status:** reproduced (reproduced=1)
**Impact:** none
**Confidence:** certain

## Finding
drm_atomic_helper_set_config leaks atomic state object when handle_conflicting_encoders fails

## Source Location
sys/dev/drm/drm_atomic_helper.c:2938-2940

## Verdict
Source-confirmed: drm_atomic_helper_set_config leaks atomic state object when handle_con. Fix applies and compiles.

## Fix Status
fixed: VALIDATED: fix.diff batch-compiled into single kernel build rc=0 -Werror on 6.5-DEVELOPMENT #0

## Summary
drm_atomic_helper_set_config() at drm_atomic_helper.c:2938-2940: after drm_atomic_state_alloc, handle_conflicting_encoders(state,true) failure does `return ret;` directly, bypassing fail: label and its drm_atomic_state_put(state). Leaked state also pins every connector/crtc/plane/mode_blob reference. Other helpers (update_plane:2769, page_flip:3382, legacy_gamma_set:4001) all use goto fail. handle_conflicting_encoders returns -EINVAL deterministically when two connectors share encoder (drm_encod