# PoC DF-1555: drm_atomic_uapi vblank_event memory leak via stubbed sync_file_create

**Class:** Memory leak (DoS)
**Cited site:** `sys/dev/drm/drm_atomic_uapi.c:1083-1090,1108-1133,1055,1213`

## Reproduction status

HW/module gated — **cannot be live-triggered on the audit QEMU guest.**

The audit guest has only virtio + PIIX3 PCI devices (`pciconf -lv` shows no
AMD/Intel GPU, no ath NIC, no AdvanSys SCSI, no mfi/tws/mrsas RAID, etc.),
so the cited code path is not reachable at runtime on this guest.

The bug is **confirmed at the source level** by tracing the cited path:line
in `sys/dev/drm/drm_atomic_uapi.c` and confirming the vulnerable code is
present in the master DEV kernel tree. The `fix.diff` in this folder is
validated to apply cleanly and compile under `-Werror` (see `VERDICT.md`).

## Mechanism

prepare_signaling allocates drm_pending_vblank_event on OUT_FENCE_PTR crtc prop (even without PAGE_FLIP_EVENT flag). setup_out_fence calls sync_file_create at 1055; on DFly this is a STUB (sync_file.h:48-53) returning NULL -> setup_out_fence returns -ENOMEM at 1057. crtc_state->event->base.fence = fence at 1132 NEVER reached. complete_signaling at 1213 cleanup predicate event && (event->base.fence || event->base.file_priv) -- both NULL -- skips -> event leaked.

## Realistic impact ceiling (on suitable HW)

deterministic kernel memory leak per atomic commit with OUT_FENCE_PTR -> DoS via memory exhaustion

## Fix

Track event_for_fence_only per crtc iteration; in the setup_out_fence error path, drm_event_cancel_free the event when it was alloc'd solely for the fence path.

See `fix.diff` for the git-apply-able patch.

## How to validate the fix

```sh
scp -F dfbsd-qemu/config fix.diff dfbsd:/root/DF-1555.diff
ssh -F dfbsd-qemu/config dfbsd 'cd /usr/src && patch -p1 --forward < /root/DF-1555.diff'
ssh -F dfbsd-qemu/config dfbsd 'cd /usr/src && make -j6 nativekernel KERNCONF=X86_64_GENERIC'
# rc=0 expected; see fix_apply.log + fix_build.log in this folder.
```