# DF-2132: dma_buf_get() returns unrefcounted pointer — UAF via dma_buf_put() over-drop

## Verdict: NOT REPRODUCED (HW-gated) — source-confirmed real bug

## Reachability
**NOT reachable on this QEMU guest.** `dma_buf_get()` is in `sys/dev/drm/linux_dma-buf.c`,
compiled into `drm.ko`. Loading `drm.ko` succeeds but creates no `/dev/dri` device nodes
(the QEMU stdvga `0x1234` is not recognized by any DRM driver). `dma_buf_get()` is called
from `drm_prime.c` (`drm_gem_prime_fd_to_handle`) which requires an open DRM file descriptor
(`/dev/dri/cardN`), which does not exist without GPU hardware.

Evidence: `kldload drm` → kldstat shows `drm.ko` loaded; `ls /dev/dri*` → "no dri devices".
PCI survey: `vgapci0: chip=0x11111234` (QEMU stdvga, not AMD/Intel/NVIDIA).

## Mechanism (source-confirmed)
`dma_buf_get()` at `sys/dev/drm/linux_dma-buf.c:168-187`:
1. `holdfp(curthread, fd, -1)` increments `f_count` on the dma_buf's `struct file`
2. Extracts `dmabuf = fp->private_data`
3. `dropfp(curthread, fd, fp)` **decrements `f_count` back** — net reference change: zero
4. Returns `dmabuf` with **no held reference**

Every caller in `drm_prime.c` (e.g. `drm_gem_prime_fd_to_handle:802→848/857/864`) then calls
`dma_buf_put(dmabuf)` which does `fdrop(dmabuf->file)` (dma-buf.h:118), decrementing `f_count`
by one **that was never added**. The file's `f_count` drops below the correct value, eventually
reaching 0 while the fd table still references it → **use-after-free** when the fd is later
closed or used.

## Primitive
- Class: reference count underflow → UAF
- The over-dropped `f_count` causes premature `struct file` free while still referenced
- On this guest (no SMAP/SMEP): a freed `struct file` reclaimed into a victim slab bucket
  could be corrupted to escalate to `uid=0` — but the trigger requires GPU hardware

## Fix
`fix.diff`: Remove the `dropfp(curthread, fd, fp)` call in `dma_buf_get()` (line 184).
The caller's `dma_buf_put()` provides the matching `fdrop()`, so the reference must be
held. The error-path `dropfp` (line 179) is correct and unchanged.