# DF-2209 — Stale pointer after kfree in drm_sysfs_connector_remove (sys/dev/drm/drm_sysfs.c:48-54)

**VERDICT: REPRODUCED — the full UAF chain ran deterministically through
the UNMODIFIED production functions: dangling kdev after remove →
immediate same-zone reclaim with forged content → the production
consumer expression (`connector->kdev->kobj.name`, intel_dp.c:5251)
returned ATTACKER-CONTROLLED data through the dangling pointer →
re-add returned success with ZERO allocations → a second remove
kfree()d the reclaimed live object (cross-object free).**

## Rig class

Verbatim-code kernel-compiled KLD harness (established drm rig pattern,
DF-2214 precedent): UNMODIFIED production add/remove extracted from the
guest `/usr/src` tree (sha256-pinned), compiled kernel-resident with
production-faithful kzalloc/kasprintf/kfree shims (slab.h:35,38 +
drm_dragonfly.c:65-94 shapes), driven with fabricated `drm_connector`
state. Natural-path trigger requires real GPU hardware this guest does
not have (`/dev/dri` absent).

## Build (on the guest, as root)

```sh
cd /root/df22/DF-2209 && ./build.sh
```

## Run

```sh
cd /root/df22/DF-2209 && ./run.sh
```

kldload → matrix at load time (CASE D is the UAF cycle, CASE F the
fixed cycle) → kldunload → dmesg capture into `run.log`.

## Expected output (CASE D highlights)

```
[2] remove: kfree(0x…) done; connector->kdev still == 0x… (DANGLING)
[3] reclaim: fresh kmalloc(56, M_DF22, M_WAITOK|M_CACHEALIGN|M_ZERO)
    returned 0x… == freed A (IMMEDIATE SAME-ZONE REUSE)
[4] consumer read connector->kdev->kobj.name -> 'DF2209-PWNED-BY-RECLAIM'
    (UAF READ returns ATTACKER-CONTROLLED data)
[5] re-add: ret==0 (SUCCESS) with rig_kzalloc_calls UNCHANGED
    (silent no-op on the DANGLING pointer)
[6] second remove: production kfree()d the RECLAIMED live object
    (CROSS-OBJECT FREE)
VERDICT: UAF CONFIRMED through verbatim drm_sysfs.c code
```

Deterministic: identical in 4 runs across two guest generations.

## Files

See VERDICT.md for the artifact map and the honest reachability +
privesc-ceiling analysis (cross-object free + info-leak-shaped read,
hardware-gated; no uid=0 chain built). Paired finding: DF-2208 (same
file, same rig, same combined fix).