DF22 RIG start: kernel-resident verbatim drm_sysfs.c add/remove (baseline) + fix.diff variants
DF22   shims: kzalloc/kfree/kasprintf mirror slab.h:35,38 and drm_dragonfly.c:65-94 with fault injection ONLY at the cited call sites
DF2208 CASE A (control): verbatim add/remove
DF22   [drm_sysfs] adding "DP-1" to sysfs
DF2208   ret=0 kdev=0xfffff80116c07cc0 name='card0-DP-1' (content capture: card%d-%s of dev->primary->index=0, connector->name='DP-1')
DF2208   offsetof(struct device, kobj.name)=8 sizeof(struct device)=56 (M_CACHEALIGN -> power-of-2 class)
DF22   [drm_sysfs] removing "DP-1" from sysfs
DF2208   after remove: connector->kdev still reads 0xfffff80116c07cc0 (baseline remove NULLs nothing); alloc_events=2 free_events=1 (delta alloc=2 free=1)
DF2208   SIDE-OBSERVATION: the kasprintf'd kobj.name string is never freed by remove() (drm_sysfs.c:52-53 frees kdev only) -> leaks 1 allocation per connector add/remove cycle
DF2208 CASE B (kasprintf==NULL injected at drm_sysfs.c:40):
DF22   [drm_sysfs] adding "DP-2" to sysfs
DF2208   ret=0 kdev=0xfffff80116c07cc0 kobj.name=0
DF2208   VERDICT: SILENT NULL PLANTED -- function reports SUCCESS (ret==0) with kdev->kobj.name==NULL; first consumer deref (intel_dp.c:5251 connector->kdev->kobj.name) hits NULL
DF22   [drm_sysfs] removing "DP-2" from sysfs
DF2209 CASE D (UAF cycle): verbatim add -> remove -> reclaim -> consume -> re-add -> remove
DF22   [drm_sysfs] adding "DP-3" to sysfs
DF2209   [1] add: kdev=0xfffff80116c07cc0 (kobj.name='card0-DP-3')
DF22   [drm_sysfs] removing "DP-3" from sysfs
DF2209   [2] remove: kfree(0xfffff80116c07cc0) done; connector->kdev still == 0xfffff80116c07cc0 (DANGLING -- drm_sysfs.c:52-53 never NULLs it)
DF2209   [3] reclaim: fresh kmalloc(56, M_DF22, M_WAITOK|M_CACHEALIGN|M_ZERO) returned 0xfffff80116c07cc0 == freed A (IMMEDIATE SAME-ZONE REUSE); block poisoned 0x41 and kobj.name forged
DF2209   [4] consumer read connector->kdev->kobj.name -> 'DF2209-PWNED-BY-RECLAIM' (UAF READ returns ATTACKER-CONTROLLED data; was 'card0-DP-3' before the free)
DF2209   [5] re-add: ret==0 (SUCCESS) with rig_kzalloc_calls UNCHANGED (3) -- guard at drm_sysfs.c:35-36 turned add into a silent no-op on the DANGLING pointer
DF22   [drm_sysfs] removing "DP-3" from sysfs
DF2209   [6] second remove: production kfree()d the RECLAIMED live object 0xfffff80116c07cc0 owned by another allocator (CROSS-OBJECT FREE); owner still holds the pointer
DF2209   [6] owner-after-free read R->kobj.name -> 0xfffff8008f90cf80 (== forged string, intact)
DF2209   VERDICT: UAF CONFIRMED through verbatim drm_sysfs.c code (dangling ptr + silent re-add + controlled reclaim + cross-object free)
DF2208 CASE E (fix.diff variants, same injections):
DF2208   [kzalloc-NULL] ret=-12 (-ENOMEM) kdev=0 -- NO fault, caller (drm_connector.c:445-446) can fail loudly
DF2208   [kasprintf-NULL] ret=-12 kdev=0 kobj.name=0 -- kdev freed and NULLed, NO silent NULL planted
DF2209 CASE F (fix.diff variants):
DF22   [drm_sysfs] adding "DP-5" to sysfs
DF22   [drm_sysfs] removing "DP-5" from sysfs
DF2209   [1] fixed remove: kdev=0 (NULLed: fix breaks the dangling pointer)
DF22   [drm_sysfs] adding "DP-5" to sysfs
DF2209   [2] fixed re-add: FRESH allocation 0xfffff80116c07c00 != freed 0xfffff80116c07cc0 (and != interposed 0xfffff80116c07cc0), kzalloc_calls 6 -> 7, name='card0-DP-5' -- no dangling, no silent no-op
DF22   [drm_sysfs] removing "DP-5" from sysfs
DF2209   VERDICT: fixed cycle clean
DF22 RIG done (baseline kzalloc-NULL panic case ARMED: sysctl kern.df2208_fire=1)
DF2208 CASE C FIRING: kzalloc==NULL injected; verbatim drm_sysfs_connector_add about to write connector->kdev->kobj.name at NULL+8 -- EXPECT FATAL TRAP
Fatal user address access from kernel mode from sysctl at ffffffff826001ec


Fatal trap 12: page fault while in kernel mode
cpuid = 0; lapic id = 0
fault virtual address	= 0x8
fault code		= supervisor write data, page not present
instruction pointer	= 0x8:0xffffffff826001ec
stack pointer	        = 0x10:0xfffff801183f5748
frame pointer	        = 0x10:0xfffff801183f5768
code segment		= base 0x0, limit 0xfffff, type 0x1b
			= DPL 0, pres 1, long 0, def32 0, gran 1
processor eflags	= interrupt enabled, resume, IOPL = 0
current process		= 1527
current thread          = pri 6 
kernel: type 12 trap, code=2

CPU0 stopping CPUs: 0x0000003e
 stopped
Stopped at      drm_sysfs_connector_add+0x58:   movq    %rax,0x8(%r12)
db>