{
  "finding_id": "DF-3865",
  "status": "not_reproduced",
  "reproduced": 0,
  "impact": "none",
  "confidence": "certain",
  "verdict": "Source-certain shim-contract bug, DFly-specific: rb_insert_color_cached (rbtree.h:100-101) discards its leftmost argument and rb_erase_cached (:102-103) never touches root->rb_leftmost, so rb_root_cached.rb_leftmost is NULL for the trees lifetime (initializer rbtree.h:175). amdgpu_vm_finis DFly-specific cleanup loop while (vm->va.rb_leftmost) (amdgpu_vm.c:3325) therefore never executes - upstreams rbtree_postorder_for_each_entry_safe (which the #ifndef branch still uses) is functionally replaced by a no-op: every amdgpu_bo_va_mapping still in the tree at VM teardown leaks (kfree at :3333 unreachable), incl. the dev_err(still active bo inside vm) case at :3313. Leak-only (Low), normally masked because GEM close removes mappings first; kernel-internal/KFD-ordered teardowns can hit it. Guest has no AMD GPU: not reproducible at runtime; defect proven from the macros alone.",
  "exploit_chain": "",
  "evidence": "VERDICT.md (macro-by-macro proof + fini loop); fix.diff swaps the loop for an rb_first()-based walk (rb_first=RB_MIN works under the shim)",
  "kernel_refs": [
    "sys/dev/drm/amd/amdgpu/amdgpu_vm.c:3325",
    "sys/dev/drm/amd/amdgpu/amdgpu_vm.c:3333",
    "sys/dev/drm/include/linux/rbtree.h:100",
    "sys/dev/drm/include/linux/rbtree.h:102",
    "sys/dev/drm/include/linux/rbtree.h:175"
  ],
  "poc_changes": "authored from scratch (static-analysis finding; no runtime trigger possible)",
  "attempts": 1,
  "guest_uname": "DragonFly dfbsd 6.5-DEVELOPMENT #0: Thu Jul 2 06:02:54 UTC 2026 root@dfbsd:/usr/obj/usr/src/sys/X86_64_GENERIC x86_64",
  "runtime_sec": 4,
  "guest_dirty": 0,
  "build_cmd": "./build.sh",
  "run_cmd": "./run.sh",
  "code_hash": "d5310f0b6ec121badb9bebae9a93489157e10dfd9de201b006e42a00df1e35ad",
  "notes": "Shim macros should also gain real leftmost maintenance for future users of rb_leftmost under this shim.",
  "recommended_fix": "Replace the dead loop with while ((mapping = rb_entry_safe(rb_first(&vm->va.rb_root), struct amdgpu_bo_va_mapping, rb))) (fix.diff); separately fix the shim macros to maintain rb_leftmost",
  "fix_status": "not_testable",
  "fix_baseline_reproduced": 0,
  "fix_patched_reproduced": 0,
  "fix_verdict": "fix.diff replaces the loop with an rb_first()-based walk; git apply --check clean; not exercisable without AMD hardware",
  "fix_evidence": "findings/poc/DF-3865/fix.diff"
}