{
 "status": "reproduced",
 "reproduced": 1,
 "impact": "none",
 "confidence": "certain",
 "verdict": "Quantified kernel-heap leak of the sc_rng_co callout array: 20000 production rdrand_attach/rdrand_detach cycles grew M_TEMP from Count=474/337K to Count=20000/3.08M (vmstat -m), exactly one ncpus-sized callout-array allocation leaked per cycle because rdrand_detach never kfree()s sc->sc_rng_co (rdrand.c:143-155).",
 "exploit_chain": "",
 "evidence": "run.log (vmstat -m before/after, +19.5K leaked allocations); rig runs the verbatim rdrand.c attach/detach pair",
 "kernel_refs": [
  "sys/dev/crypto/rdrand/rdrand.c:126",
  "sys/dev/crypto/rdrand/rdrand.c:143"
 ],
 "poc_changes": "verbatim rdrand.c compiled into the rig with only symbol renames; attach/detach called in a loop on a loaned softc",
 "attempts": 2,
 "runtime_sec": 300,
 "guest_dirty": 0,
 "build_cmd": "see build.sh (dfmisc.ko with verbatim rdrand)",
 "run_cmd": "vmstat -m | grep temp; sysctl \"kern.dfmiscgo=rdrand 20000\"; vmstat -m | grep temp",
 "notes": "Impact ceiling: resource exhaustion (kernel heap) on repeated driver reattach; detach is only reachable via module unload/devclass teardown, so severity Low is right.",
 "recommended_fix": "kfree(sc->sc_rng_co, M_TEMP) in rdrand_detach after the callout_terminate loop",
 "finding_id": "DF-2404",
 "guest_uname": "DragonFly dfbsd 6.5-DEVELOPMENT DragonFly 6.5-DEVELOPMENT #0: Thu Jul  2 06:02:54 UTC 2026 root@dfbsd:/usr/obj/usr/src/sys/X86_64_GENERIC x86_64",
 "runner": "df-bsd-reviewer",
 "code_hash": "c3e6055258a4e7ac392e208f28967a4942c9379a32298d7d7e255178ea9d82ec"
}