{
  "finding_id": "DF-2216",
  "guest_uname": "DragonFly dfbsd 6.5-DEVELOPMENT DragonFly 6.5-DEVELOPMENT #1: Tue Oct 20 23:24:18 UTC 2026     root@dfbsd:/usr/obj/usr/src/sys/DFV22X  x86_64",
  "code_hash": "c646506a8cbeda4dcb0ade737617a507fac86cf3d381b7df14e25aad5ab10fae",
  "tested_at": "2026-10-20",
  "verdict": "REPRODUCED / FIX VALIDATED",
  "impact": "denial_of_service",
  "confidence": "certain",
  "reproduce": {
    "build": "sh build.sh (batch harness kernel DFV22X = X86_64_GENERIC + device dfverify; verbatim linux_dmi.c sha256-gated)",
    "run": "install DFV22X kernel, reboot, sysctl kern.df22x_run=1 (root), read DF2216 lines from dmesg",
    "expected": "CONTROL paired kgetenv/kfreeenv delta=0; BASELINE dmi_match x16384 leaks 1703936 B (104 B/call, all four arms, both return paths); FIXED delta=0"
  },
  "kernel_refs": ["sys/dev/drm/linux_dmi.c:44", "sys/dev/drm/linux_dmi.c:49", "sys/dev/drm/linux_dmi.c:54", "sys/dev/drm/linux_dmi.c:59", "sys/kern/kern_environment.c:242", "sys/dev/drm/radeon/atombios_encoders.c:2251"],
  "artifacts": [
    {"path": "rig_head.c", "type": "rig-source", "desc": "shared batch rig head (includes, provenance comments)"},
    {"path": "rig_mid.c", "type": "rig-source", "desc": "verbatim #includes of the four production files + kfree macro restore + fixed prototypes"},
    {"path": "rig_tail.c", "type": "rig-source", "desc": "malloc-accounting meter + DF2216/2220/2223/2224 test sections + sysctl trigger"},
    {"path": "build.sh", "type": "build-script", "desc": "sha256 gates, verbatim kvasprintf extraction, fix.diff scratch + fixed-variant extraction, kernel-compile"},
    {"path": "run.sh", "type": "run-script", "desc": "sysctl trigger + dmesg extraction"},
    {"path": "fix.diff", "type": "suggested-fix", "desc": "kfreeenv(s) on every path of all four dmi_match arms"},
    {"path": "build.log", "type": "build-log", "desc": "FULL untrimmed nativekernel DFV22X build"},
    {"path": "run.log", "type": "run-log", "desc": "FULL decisive rig output (all four findings)"},
    {"path": "run_section.log", "type": "run-log", "desc": "DF-2216 lines only"},
    {"path": "run.first_meterbug.log", "type": "run-log", "desc": "first iteration: ks_loosememuse double-count artifact, engineering record"},
    {"path": "env.txt", "type": "environment", "desc": "guest env + all provenance hashes"},
    {"path": "VERDICT.md", "type": "verdict", "desc": "full narrative"},
    {"path": "README.md", "type": "readme", "desc": "build/run/expected"},
    {"path": "manifest.json", "type": "manifest", "desc": "this file"},
    {"path": "verdict.json", "type": "verdict", "desc": "machine verdict for persist_poc.py"}
  ]
}