# DF-3865 VERDICT — not_reproduced (hardware-gated); shim defect certain at source

## Runtime

No AMD GPU on the audit guest → no VM is ever created → fini path never
runs. status = not_reproduced, reproduced = 0. (The defect is provable
purely from the shim macros; no execution needed.)

## Source proof

1. sys/dev/drm/include/linux/rbtree.h:100-101:

```c
#define	rb_insert_color_cached(node, root, leftmost)			\
	linux_root_RB_INSERT_COLOR((struct linux_root *)(&(root)->rb_root), (node))
```

   The `leftmost` parameter is discarded; no write to
   `root->rb_leftmost` anywhere in the macro.

2. rbtree.h:102-103: `rb_erase_cached` likewise only removes.

3. rbtree.h:175: `#define LINUX_RB_ROOT_CACHED (struct rb_root_cached) { {NULL, }, NULL }`
   → `rb_leftmost` starts NULL and stays NULL forever.

4. amdgpu_vm.c:3055 `vm->va = LINUX_RB_ROOT_CACHED;` → NULL leftmost.
   amdgpu_vm.c:3316-3334 (the __DragonFly__ branch) loops
   `while (vm->va.rb_leftmost)` — dead; the kfree at 3333 is unreachable.
   Upstream v4.20 uses `rbtree_postorder_for_each_entry_safe` here
   (verified) — the DFly replacement is the divergence.

5. Consequence: every mapping still present in `vm->va` at fini leaks
   (kfree skipped). Affected scenario: fini with non-empty tree
   (amdgpu_vm.c:3313 even prints "still active bo inside vm" for it).

Severity Low (bounded leak, rare path, no memory-safety violation), but a
real, certain shim-contract bug — and a landmine for any other code that
trusts rb_leftmost under this shim.

## Fix validation

fix.diff replaces the dead loop with an rb_first()-based loop
(rbtree.h:97 `rb_first` = RB_MIN — functional under the shim);
`git apply --check` clean. Not exercisable on this guest: fix_status =
not_testable.

## Fix status (batch validation)
Applied with the 36 sibling fix.diffs of this batch in findings/poc/_batch41/all_fixes.patch; single in-guest `make -j6 nativekernel KERNCONF=X86_64_GENERIC` completed RC=0 with zero errors under -Werror (full log: findings/poc/_batch41/fix_build8.log). Behavior A/B intentionally skipped for this Info-tier item.