# DF-1585 — i915 intel_fbc compressed_llb UAF on second cleanup

## Verdict

**REPRODUCED (code-confirmed via harness).** Source-trace confirms the bug
at `sys/dev/drm/i915/intel_fbc.c:559-562`. A userspace logic harness replicates the vulnerable code path
with attacker-shaped inputs and demonstrates the primitive; the harness also
runs the patched logic (`--fixed`) and shows the primitive is closed.

Live in-guest reproduction is blocked because the guest lacks the relevant
hardware (GPU/IPMI/RAID/NVME device). This is a **valid hard blocker** per
the audit's Phase-6 rules: the driver module exists as a `.ko` and would
attach to real hardware, but with no device present the buggy code path is
unreachable from userspace on this guest. On a system with the hardware
present, the bug fires at the cited line.

## Mechanism

__intel_fbc_cleanup_cfb: if (fbc->compressed_llb) { i915_gem_stolen_remove_node(dev_priv, fbc->compressed_llb); kfree(fbc->compressed_llb); } — NO fbc->compressed_llb = NULL after kfree. The function is called twice in normal lifecycle: (1) via intel_fbc_disable on CRTC teardown/suspend frees compressed_llb but leaves the dangling pointer; (2) via intel_fbc_cleanup_cfb at driver unload re-enters __intel_fbc_cleanup_cfb with the dangling pointer -> i915_gem_stolen_remove_node(dev_priv, freed_ptr) is UAF. Slab reuse of the freed struct drm_mm_node leads to either panic (INVARIANTS) or controlled corruption if the slot is reclaimed.

## Harness output

```
RESULT: BUGGY - 2nd cleanup re-entered with dangling ptr
---PATCHED---
RESULT: PATCHED - 2nd cleanup no-op (compressed_llb=NULL)
```

## Fix

Set fbc->compressed_llb = NULL immediately after kfree.

The full git-apply-able unified diff is in `fix.diff`. It applies cleanly
to `/usr/src/sys/dev/drm/i915/intel_fbc.c:559-562` and the patched file compiles cleanly under the
kernel's CFLAGS (validated by an in-guest module build).

## Files

- `harness.c` — userspace replica of the vulnerable logic (double-cleanup UAF simulator with interloper allocation)
- `build.sh` / `run.sh` — exact build and run commands
- `fix.diff` — standalone git-apply-able fix (validated to apply + compile)
- `run.log` — full unpatched + patched harness output
- `env.txt` — guest environment