# VERDICT -- DF-2020 (Low)

**Verdict:** REPRODUCED (source-only)

**Impact:** leak:DRM auth magic tokens via world-readable sysctl; HW-gated (needs DRM/GPU), source-confirmed

**Confidence:** likely

## Mechanism (source-traced)

drm_getmagic allocates a per-fd auth magic token (drm_auth.c:64-68 via idr_alloc starting at id 1, sequential integers). The same token is printed world-readably by drm_clients_info (drm_sysctl.c:290-294) which prints priv->magic for every open DRM file under the CTLFLAG_RD-only sysctl hw.dri.N.clients. The drm_getclient ioctl already zeroes client->magic (drm_ioctl.c:196) for this reason; the sysctl handler does not match.

## Why not runtime-reproduced

The guest (DragonFlyBSD 6.5-DEVELOPMENT #0 master DEV, KVM) has NO matching
hardware: pciconf shows no mfi/tws/iir RAID controller and no amdgpu/DRM GPU;
the driver therefore cannot attach and the vulnerable path is not runtime-
triggerable here. The defect was **confirmed at the source level** by tracing
the cited `path:line` against `sys/`, and the proposed fix was applied and the
affected module (`drm`) built clean with `-Werror` (see fix_build.log).

## Fix

drm_sysctl.c:290-294: redact priv->magic (print '-') in the world-readable hw.dri.N.clients sysctl, matching the drm_getclient ioctl fix.

The standalone, git-apply-able diff is `fix.diff`.