{
  "finding_id": "DF-2220",
  "guest_uname": "DragonFly dfbsd 6.5-DEVELOPMENT DragonFly 6.5-DEVELOPMENT #1: Tue Oct 20 23:24:18 UTC 2026     root@dfbsd:/usr/obj/usr/src/sys/DFV22X  x86_64",
  "code_hash": "c646506a8cbeda4dcb0ade737617a507fac86cf3d381b7df14e25aad5ab10fae",
  "tested_at": "2026-10-20",
  "verdict": "REPRODUCED / FIX VALIDATED",
  "impact": "denial_of_service",
  "confidence": "certain",
  "reproduce": {
    "build": "sh build.sh (batch harness kernel DFV22X; verbatim linux_kobject.c + verbatim kvasprintf, sha256-gated)",
    "run": "install DFV22X kernel, reboot, sysctl kern.df22x_run=1 (root), read DF2220 lines from dmesg",
    "expected": "CONTROL paired kmalloc/kfree delta=0; BASELINE 16384 init/release cycles leak 655360 B (40 B/cycle; name allocation SURVIVES release with content intact); FIXED delta=0"
  },
  "kernel_refs": ["sys/dev/drm/linux_kobject.c:39", "sys/dev/drm/linux_kobject.c:45", "sys/dev/drm/linux_kobject.c:50", "sys/dev/drm/drm_dragonfly.c:67", "sys/dev/drm/ttm/ttm_bo.c:1565", "sys/dev/drm/ttm/ttm_memory.c:257"],
  "artifacts": [
    {"path": "rig_head.c", "type": "rig-source", "desc": "shared batch rig head"},
    {"path": "rig_mid.c", "type": "rig-source", "desc": "verbatim production includes + fixed prototypes"},
    {"path": "rig_tail.c", "type": "rig-source", "desc": "meter + test sections incl. production-shape kobject cycles and non-freeing semantics probe"},
    {"path": "build.sh", "type": "build-script", "desc": "provenance chain + fixed-variant extraction + kernel-compile"},
    {"path": "run.sh", "type": "run-script", "desc": "sysctl trigger + dmesg extraction"},
    {"path": "fix.diff", "type": "suggested-fix", "desc": "save kobj->name before release callback, kfree(name, M_DRM) after (upstream kobject_cleanup semantics)"},
    {"path": "build.log", "type": "build-log", "desc": "FULL untrimmed nativekernel DFV22X build"},
    {"path": "run.log", "type": "run-log", "desc": "FULL decisive rig output"},
    {"path": "run_section.log", "type": "run-log", "desc": "DF-2220 lines only"},
    {"path": "run.first_meterbug.log", "type": "run-log", "desc": "first iteration meter artifact record"},
    {"path": "env.txt", "type": "environment", "desc": "guest env + hashes"},
    {"path": "VERDICT.md", "type": "verdict", "desc": "full narrative"},
    {"path": "README.md", "type": "readme", "desc": "build/run/expected"},
    {"path": "manifest.json", "type": "manifest", "desc": "this file"},
    {"path": "verdict.json", "type": "verdict", "desc": "machine verdict for persist_poc.py"}
  ]
}