# DF-1977 Verification

## Verdict
**SOURCE-CONFIRMED, INCONCLUSIVE-RUNTIME (HW/module gated).**

The cited defect exists in the audited source at `sys/dev/drm/linux_workqueue.c:243-286`.
Part of the drm compatibility layer (module, not in GENERIC).

## Mechanism (source-only confirmation)
Two compounding defects:
(1) destroy_workqueue (243-253) has ENTIRE teardown inside #if 0 XXX TODO —
only calls drain_workqueue and returns; wq struct, separately-kmallocd
wq->workers array (line 214), and all ncpus worker threads leaked forever.
(2) drain_workqueue (267-286) holds worker_lock during tsleep (deadlocking
the worker) and only checks STAILQ_EMPTY — but process_all_work removes work
at line 73 BEFORE running it, so in-flight work is invisible to the drain
check. Caller frees work struct after drain returns → UAF.

## Recommended fix
Implement destroy_workqueue: drain, set exiting flag on all workers, wakeup,
wait for threads to exit (lwkt_exit), free workers array + wq struct. Fix
drain_workqueue: release lock during sleep, also wait for in_flight count to
reach zero. Add in_flight/exiting fields to workqueue_worker.

The full `git apply`-able diff lives in `fix.diff` in this folder.