# DF-2208 — Missing NULL checks in drm_sysfs_connector_add (sys/dev/drm/drm_sysfs.c:39-42)

**VERDICT: false_positive for the filed OOM trigger on DragonFly
(impact none); the missing-check code shape is real and was proven
mechanically, including an actual Fatal trap 12 at
`drm_sysfs_connector_add+0x58` when the NULL is injected.**

## Rig class

Verbatim-code kernel-compiled KLD harness (established drm rig pattern,
DF-2214 precedent): the UNMODIFIED production function is extracted from
the guest `/usr/src` tree (sha256-pinned, byte-identical to the audited
tree), compiled kernel-resident with production-faithful allocator
shims whose only delta is optional allocation-fault injection at the two
cited call sites, and driven with fabricated `drm_connector` state.

## Build (on the guest, as root)

```sh
cd /root/df22/DF-2208 && ./build.sh
```

Verifies tree hash `331166b1…` == audited tree, extracts add (lines
31-46) and remove (48-54) by line-range AND pattern (both must match,
hashes pinned), applies `fix.diff` to a scratch copy for the renamed
`*_fixed` variants, assembles `df22_rig.c` and builds `df22_rig.ko`
with kernel-context flags (`-D_KERNEL -nostdinc -mcmodel=kernel …`, the
DF-2214 flag set that avoids the link_elf_obj relatab loader panic).

## Run

```sh
cd /root/df22/DF-2208 && ./run.sh    # non-panicking matrix -> run.log
cd /root/df22/DF-2208 && ./fire.sh   # THE PANIC: guest dies by design
```

`run.sh`: kldload, matrix at load time, kldunload, dmesg capture.
`fire.sh`: kldload then `sysctl kern.df2208_fire=1` — injects
`kzalloc==NULL` at drm_sysfs.c:39 and calls the verbatim add; line 40
writes at NULL+8 and the kernel takes a fatal page fault. Afterwards
reset the guest from the host: `dfbsd-qemu/vm.sh reset with-src`.

## Expected output

- run.log CASE B: `ret=0 kdev=… kobj.name=0 … SILENT NULL PLANTED`
- run.log CASE E (fixed): `ret=-12 (-ENOMEM) kdev=0 … NO fault`
- panic.txt (fire): `Fatal trap 12 … fault virtual address = 0x8 …
  Stopped at drm_sysfs_connector_add+0x58: movq %rax,0x8(%r12)`
- Why the filed trigger is dead on DFly: `GFP_KERNEL ==
  M_WAITOK|M_CACHEALIGN`; `_kmalloc` without `M_NULLOK` panics or
  blocks, never returns NULL (kern_slaballoc.c:869-878, 1722-1724,
  1786-1800). Full chain in VERDICT.md.

## Files

See VERDICT.md for the artifact map (run.log, run.2.log,
run_dmesg.log, build.log, panic.txt, fire_serial_full.log,
fix_module_build.log, df22_rig.c, env.txt, fix.diff).
Paired finding: DF-2209 (same file, same rig, same combined fix).