{
  "finding_id": "DF-3768",
  "status": "not_reproduced",
  "reproduced": 0,
  "impact": "none",
  "confidence": "certain",
  "verdict": "Source-certain DFly-specific defect: i915_gem_init_gtt (i915_gem_gtt.c:2968) registers the GMADR aperture as a fictitious vm_page range but i915_ggtt_cleanup_hw (i915_gem_gtt.c:2992-3029) never calls vm_phys_fictitious_unreg_range. The drm_vm.c shim inserts into the first free of 8 global slots without duplicate detection, so every driver re-attach (kldload/kldunload, re-probe) leaks the previous fake-vm_page array (~6-8MB per cycle for a 256MB aperture) and after 8 cycles registration returns EBUSY and the driver can never attach again until reboot. Root-triggered resource leak/availability issue, no memory corruption, no unprivileged path. Runtime reproduction impossible on the audit guest: virtio-only GPU (chip 0x1111:1234), no i915kms.ko present, module not loaded \u2014 verified live; hence not_reproduced with source-level certainty. radeon in the same tree performs the symmetric unregister (radeon_device.c:1566), confirming the intended lifecycle.",
  "exploit_chain": "",
  "evidence": "README.md (finding + proof points), VERDICT.md (why real, why not worse), env.txt (guest GPU/module absence), upstream_v419_vs_dfbsd.diff (shows the DFly-only registration block), trigger.sh (root repro for maintainers with Intel hw), fix.diff",
  "kernel_refs": [
    "sys/dev/drm/i915/i915_gem_gtt.c:2966",
    "sys/dev/drm/i915/i915_gem_gtt.c:2992",
    "sys/dev/drm/drm_vm.c:144",
    "sys/dev/drm/drm_vm.c:172",
    "sys/dev/drm/drm_vm.c:203",
    "sys/dev/drm/drm_vm.c:207",
    "sys/dev/drm/radeon/radeon_device.c:1566",
    "sys/dev/drm/i915/i915_gem.c:2391"
  ],
  "poc_changes": "n/a \u2014 no seeded PoC; wrote trigger.sh from scratch for hardware maintainers",
  "attempts": 1,
  "guest_uname": "DragonFly dfbsd 6.5-DEVELOPMENT #0: Thu Jul  2 06:02:54 UTC 2026 root@dfbsd:/usr/obj/usr/src/sys/X86_64_GENERIC x86_64",
  "runtime_sec": 30,
  "guest_dirty": 0,
  "build_cmd": "n/a (no build; runtime trigger requires Intel graphics hardware)",
  "run_cmd": "sh trigger.sh  # on a DragonFly host with i915 hardware, as root",
  "code_hash": "",
  "notes": "Severity Low: root-only trigger (kldload/kldunload). Leak grows ~aperture/4K * sizeof(vm_page) per attach cycle; 8-cycle hard ceiling then permanent graphics-attach failure until reboot. Stale registered segment also keeps matching the BAR range after unload. Guest check performed 2026-09-16: pciconf shows 0x1111:1234 virtio VGA, /boot/kernel/i915kms.ko absent, kldstat has no i915.",
  "recommended_fix": "Call vm_phys_fictitious_unreg_range(gmadr.start, gmadr.start+min(total,mappable_end)) from i915_ggtt_cleanup_hw() after iomap teardown, mirroring radeon_device.c:1566 \u2014 see fix.diff",
  "fix_status": "not_testable",
  "fix_baseline_reproduced": 0,
  "fix_patched_reproduced": 0,
  "fix_verdict": "fix.diff authored by inspection (mirrors radeons proven lifecycle); cannot be runtime-validated on the virtio-only audit guest",
  "fix_evidence": "findings/poc/DF-3768/fix.diff"
}