{
 "finding_id": "DF-2208",
 "status": "not_reproduced",
 "reproduced": 0,
 "impact": "none",
 "confidence": "certain",
 "verdict": "FALSE POSITIVE for the filed threat model on DragonFly, with the code-shape claim mechanically proven. The missing NULL checks are real at drm_sysfs.c:39-42 (kzalloc result assigned then immediately dereferenced at :40; kasprintf result stored unchecked; unconditional return 0 at :45): a verbatim-code KLD rig compiled the UNMODIFIED production function kernel-resident (tree lines 31-46, sha256-pinned, guest tree byte-identical to the audited tree) and (a) with kasprintf==NULL injected it returned ret==0 with kdev->kobj.name==NULL planted (SILENT NULL PLANTED, run.log CASE B), (b) with kzalloc==NULL injected via sysctl kern.df2208_fire=1 it executed the cited write and the kernel died: Fatal trap 12, fault virtual address 0x8, supervisor write, Stopped at drm_sysfs_connector_add+0x58 movq %rax,0x8(%r12) (panic.txt; offsetof(struct device, kobj.name)==8 matches production layout). HOWEVER the filed trigger (unprivileged user induces OOM so kzalloc/kasprintf return NULL) cannot occur on this platform: GFP_KERNEL is M_WAITOK|M_CACHEALIGN (gfp.h:16) and _kmalloc without M_NULLOK either panics (kern_slaballoc.c:869-878 zone limit, :1722-1724 kernel_map exhaustion) or blocks retrying forever (:1786-1800 page starvation) -- it never returns NULL; kvasprintf drm_dragonfly.c:78-79 checks NULL only because the Linux original can fail. Under the claimed OOM conditions the kernel panics INSIDE the allocator before drm_sysfs.c:40 can run with NULL. The missing checks remain correct hardening (and are required if allocator semantics or gfp flags ever change), and the fix is A/B validated: the fixed variant returns -ENOMEM with kdev==NULL under identical injections, and fix.diff applied to the guest /usr/src rebuilt the production drm KLD clean with -Werror.",
 "exploit_chain": "",
 "evidence": "panic.txt: Fatal trap 12, fault virtual address 0x8, supervisor write data, Stopped at drm_sysfs_connector_add+0x58: movq %rax,0x8(%r12) -- the cited write through the injected-NULL kzalloc result at drm_sysfs.c:40. run.log CASE B: ret=0 kdev!=NULL kobj.name=0 SILENT NULL PLANTED. run.log CASE E: FIXED variant ret=-12 kdev=0 no fault. Reachability kill chain: sys/dev/drm/include/linux/gfp.h:16 (GFP_KERNEL = M_WAITOK|M_CACHEALIGN), sys/dev/drm/include/linux/slab.h:35 (kzalloc -> kmalloc M_DRM), sys/kern/kern_slaballoc.c:869-878 (NULL only with M_NULLOK, else panic malloc limit exceeded), :1722-1724 (NULL only with M_NULLOK, else panic kernel_map ran out of space), :1786-1800 (M_WAITOK vm_wait retry, never NULL), sys/dev/drm/drm_dragonfly.c:77-79 (kvasprintf NULL check dead for GFP_KERNEL on DFly). fix_module_build.log: patched real drm module rebuilt clean with -Werror.",
 "kernel_refs": [
  "sys/dev/drm/drm_sysfs.c:39",
  "sys/dev/drm/drm_sysfs.c:40",
  "sys/dev/drm/drm_sysfs.c:45",
  "sys/dev/drm/drm_sysfs.c:93-95",
  "sys/dev/drm/include/linux/gfp.h:16",
  "sys/dev/drm/include/linux/slab.h:35",
  "sys/dev/drm/drm_dragonfly.c:77-79",
  "sys/kern/kern_slaballoc.c:869-878",
  "sys/kern/kern_slaballoc.c:1722-1724",
  "sys/kern/kern_slaballoc.c:1786-1800",
  "sys/dev/drm/drm_connector.c:444-446",
  "sys/dev/drm/i915/intel_dp.c:5251"
 ],
 "poc_changes": "No seed pack existed; rig authored from scratch in verify mode following the DF-2214 verbatim-KLD pattern. Iterations: (1) <machine/stdarg.h> does not define va_list in the merged kmod namespace -- switched to <sys/stdarg.h>; (2) the DF-2209 reclaim fix (128-byte class for the planted string) was needed because a same-class helper allocation stole the freed slot; (3) fire case moved behind sysctl kern.df2208_fire so the non-panicking matrix completes before the deliberate fatal trap; guest was reset with-src after the panic run and after fix validation.",
 "attempts": 3,
 "guest_uname": "DragonFly dfbsd 6.5-DEVELOPMENT DragonFly 6.5-DEVELOPMENT #0: Thu Jul  2 06:02:54 UTC 2026     root@dfbsd:/usr/obj/usr/src/sys/X86_64_GENERIC  x86_64",
 "runtime_sec": 60,
 "guest_dirty": 0,
 "build_cmd": "cd findings/poc/DF-2208 && ./build.sh  # provenance-checked extraction + cc 8.3 -D_KERNEL -nostdinc kernel-context KLD build of baseline+fixed variants",
 "run_cmd": "cd findings/poc/DF-2208 && ./run.sh   # kldload df22_rig.ko: matrix to dmesg; then ./fire.sh (sysctl kern.df2208_fire=1) -> fatal trap 12 at drm_sysfs_connector_add+0x58, guest dies by design",
 "code_hash": "7453d0b212f35d0757a1ad884165fca65a2f558ec17c9b04ec21b916b54b7a97",
 "notes": "Side observation folded into fix.diff: drm_sysfs_connector_remove frees only kdev, so the kasprintfd kobj.name string leaks one allocation per connector add/remove cycle (run.log CASE A: alloc=2 free=1). Severity Low as filed is right; the missing checks are defense-in-depth on DFly, mandatory semantics on Linux-style GFP behavior. Guest left up and clean after reset with-src: pristine tree hash 331166b1... verified, kldstat shows kernel+ehci+xhci only, /root/df22 removed.",
 "recommended_fix": "Check kzalloc and kasprintf results in drm_sysfs_connector_add and return -ENOMEM (freeing kdev and NULLing it on the kasprintf failure) -- see fix.diff hunk 1; remove-half (shared with DF-2209) in hunk 2.",
 "fix_status": "fixed",
 "fix_baseline_reproduced": 1,
 "fix_patched_reproduced": 0,
 "fix_validated": 1,
 "fix_diff": "findings/poc/DF-2208/fix.diff",
 "fix_verdict": "A/B validated in the same verbatim KLD: with identical kzalloc/kasprintf NULL injections the FIXED add returns ret=-ENOMEM with connector->kdev==NULL and plants nothing (run.log CASE E), so drm_connector_register (drm_connector.c:445-446) can fail loudly; the injected-NULL write fault no longer exists on the fixed path. Additionally fix.diff was applied to the guest /usr/src tree and the production drm KLD module rebuilt clean with -Werror (fix_module_build.log, drm.ko relinked 780368 bytes). Full-kernel runtime validation is not meaningful on this guest: no DRM device (/dev/dri absent, drm.ko unattached, runtime kldload of stock drm GPFs on this guest) -- DF-2214 precedent.",
 "fix_evidence": "run.log CASE E lines: [kzalloc-NULL] ret=-12 (-ENOMEM) kdev=0 -- NO fault; [kasprintf-NULL] ret=-12 kdev=0 kobj.name=0 -- kdev freed and NULLed, NO silent NULL planted. fix_module_build.log: cc ... -Werror -c drm_sysfs.c + final ld -r -o drm.ko, rc=0, zero compile errors."
}