# DF-3865 — DragonFly rbtree shim never maintains `rb_root_cached.rb_leftmost`; `amdgpu_vm_fini()`'s mapping-cleanup loop is dead code → permanent mapping leak

Files: `sys/dev/drm/amd/amdgpu/amdgpu_vm.c` (fini loop), `sys/dev/drm/include/linux/rbtree.h` (shim)

## Root cause

The DFly compat shim implements the Linux leftmost-cached rbtree API without
the cache:

- rbtree.h:100-101 `rb_insert_color_cached(node, root, leftmost)` — macro
  **ignores the `leftmost` argument** and only runs INSERT_COLOR; it never
  writes `root->rb_leftmost`.
- rbtree.h:102-103 `rb_erase_cached(node, root)` — only RB_REMOVE; never
  updates `root->rb_leftmost`.
- rbtree.h:104 `rb_first_cached` = RB_MIN over the real tree (correct).
- rbtree.h:175 `LINUX_RB_ROOT_CACHED` initializes `rb_leftmost = NULL`.

Consequently `rb_root_cached.rb_leftmost` is NULL for the lifetime of the
tree. `amdgpu_vm_fini()` (amdgpu_vm.c:3316-3334) replaced the upstream
postorder cleanup with:

```c
	while (vm->va.rb_leftmost) {          /* amdgpu_vm.c:3325 — never true */
		mapping = container_of((void *)vm->va.rb_leftmost, ...);
		list_del(&mapping->list);
		amdgpu_vm_it_remove(mapping, &vm->va);
		kfree(mapping);
	}
```

The loop body never executes: any `amdgpu_bo_va_mapping` still in the
interval tree at VM teardown is silently **leaked** (its 72-byte allocation
plus rb node), and the `dev_err("still active bo inside vm")` case
(amdgpu_vm.c:3313-3315) degenerates to leak-without-cleanup. This is a
DragonFly-specific divergence (upstream uses
`rbtree_postorder_for_each_entry_safe`, which works).

Normally the tree is empty at fini because the GEM close path removes all
mappings; the leak manifests for mappings added by kernel-internal callers
or any close-ordering that leaves stray mappings (KFD paths).

## Fix

`fix.diff` swaps the dead loop for an `rb_first()`-based walk (RB_MIN works
under the shim). The shim macros should also grow real leftmost maintenance
for other future users — the same broken pattern is latent for anyone else
using rb_leftmost directly.