{
 "finding_id": "DF-2962",
 "status": "reproduced",
 "reproduced": 1,
 "impact": "none",
 "confidence": "certain",
 "verdict": "Mechanically reproduced via the harness on the stock guest for the sharpest of the three gaps: double kobj_init on the same object inflated the class refcount monotonically (refs 1 -> 2 -> 3 after three inits; still 2 after kobj_delete - the leaked refs pin the class and its 2056-byte compiled ops table forever, which for a KLD-registered class leaks kernel memory per load/unload cycle). kobj_delete on an uninitialized object NULL-derefs obj->ops->cls (subr_kobj.c:266) and kobj_lookup_method_mi recurses over baseclasses with no cycle/depth guard - both confirmed by reading; all require a buggy privileged-authored consumer (none in-tree; callers audited balanced in pass 2). On the fix kernel refs stay 1 across re-inits (previous reference released) and return to 0 after delete.",
 "exploit_chain": "double kobj_init -> permanent class ref leak -> KLD class+ops pinned across load/unload cycles",
 "evidence": "harness.log T12: refs 1 2 3 then 2 after delete; fix kernel T12: 1 1 1 then 0",
 "kernel_refs": [
  "sys/kern/subr_kobj.c:257",
  "sys/kern/subr_kobj.c:266",
  "sys/kern/subr_kobj.c:137"
 ],
 "poc_changes": "trivial kobj_class with empty method table; KOBJ_FIELDS object on static storage",
 "attempts": 1,
 "guest_uname": "DragonFly dfbsd 6.5-DEVELOPMENT #0: Thu Jul  2 06:02:54 UTC 2026 root@dfbsd:/usr/obj/usr/src/sys/X86_64_GENERIC x86_64",
 "runtime_sec": 25,
 "guest_dirty": 0,
 "build_cmd": "cd /root/h41 && make",
 "run_cmd": "kldload ./h41.ko; sysctl -w debug.h41.cmd=12",
 "code_hash": "85d6e241caa2a7fb1fb44b80c7736a4e83c36d29314b0c96ce91769bc9bdf839",
 "notes": "Availability/leak only; developer-error-gated",
 "recommended_fix": "Release the previous class reference on re-init; guard delete; cap baseclass recursion depth",
 "fix_status": "fixed",
 "fix_baseline_reproduced": 1,
 "fix_patched_reproduced": 0,
 "fix_kernel_uname": "DragonFly dfbsd 6.5-DEVELOPMENT #1: Mon Oct 26 01:57:23 UTC 2026 root@dfbsd:/usr/obj/usr/src/sys/X86_64_GENERIC x86_64 (h41 fix kernel, all 41 hardening fixes applied)",
 "fix_verdict": "A/B: baseline monotonic leak; fix kernel stable refs (release-prev-ref on re-init, delete NULL guard, lookup depth cap)."
}