BUILD_EXIT=0
=== DF-1727 linuxkpi alloc_page() drops __GFP_ZERO harness ===
Caller requested gfp_flags=0x100 (incl __GFP_ZERO=M_ZERO=0x100)
alloc_page() actually passed vm_page_alloczwq flags=0x7
VM_ALLOC_ZERO bit (0x8) present in passed flags? NO

VERDICT: BUG CONFIRMED. The shim's flags argument is parsed
        only for GFP_DMA32 and otherwise discarded, so
        __GFP_ZERO never reaches the allocator. Cold-pool
        TTM page allocations map stale/recycled kernel
        memory into userspace via ttm_bo_vm_fault_dfly.
RUN_EXIT=0