{
  "finding_id": "DF-3913",
  "status": "inconclusive",
  "reproduced": 0,
  "impact": "none",
  "confidence": "certain",
  "verdict": "Source-certain error-path memory leak: intel_sdvo_connector_alloc() kzallocs an intel_sdvo_connector_state and installs it as connector->state (intel_sdvo.c:2481,2487), but when intel_sdvo_connector_init() fails, intel_sdvo_dvi_init/tv_init/analog_init/lvds_init (intel_sdvo.c:2541-2544, 2574-2577, 2620-2623, 2656-2659) kfree only the connector, leaking the ~152-byte state. One-shot, probe-time-only, requires drm_connector_init failure (ENOMEM/IDA exhaustion) on real Intel SDVO hardware; no UAF, no info leak, not user-triggerable. Runtime verification impossible on the audit guest: only PCI display device is QEMU Bochs VGA (chip 0x1234:1111, run.log), i915 never attaches, intel_sdvo_init() cannot execute - hence inconclusive rather than not_reproduced. Upstream-inherited (identical code in Linux through v5.20 removal).",
  "exploit_chain": "",
  "evidence": "README.md (leak path + hardware procedure); VERDICT.md (full pass-2 hunt incl. 15 killed candidate classes with path:line); faultinject.diff (forces the exact buggy block on real HW, git-apply --check clean); probe.sh + run.log + env.txt (guest hardware gate); fix.diff (4-hunk fix, git apply --check OK)",
  "kernel_refs": [
    "sys/dev/drm/i915/intel_sdvo.c:2481",
    "sys/dev/drm/i915/intel_sdvo.c:2487",
    "sys/dev/drm/i915/intel_sdvo.c:2541",
    "sys/dev/drm/i915/intel_sdvo.c:2574",
    "sys/dev/drm/i915/intel_sdvo.c:2620",
    "sys/dev/drm/i915/intel_sdvo.c:2656",
    "sys/dev/drm/drm_atomic_helper.c:3740"
  ],
  "poc_changes": "No PoC seed existed (first finding on this file). Authored faultinject.diff to force the exact failure block (git-apply-verified) and probe.sh to record the guest hardware gate; runtime demonstration requires Intel SDVO hardware absent from the QEMU guest.",
  "attempts": 1,
  "guest_uname": "DragonFly dfbsd 6.5-DEVELOPMENT #0: Thu Jul 2 06:02:54 UTC 2026 root@dfbsd:/usr/obj/usr/src/sys/X86_64_GENERIC x86_64",
  "runtime_sec": 60,
  "guest_dirty": 0,
  "build_cmd": "n/a on audit guest (no Intel GPU); on real HW: apply faultinject.diff, cd /usr/src/sys/conf && make LINT64NOUP? -> standard kernel/i915.ko rebuild + boot",
  "run_cmd": "dmesg | grep DF3913  (after booting fault-injected kernel on Intel SDVO hardware); ./probe.sh on guest documents the gate",
  "code_hash": "205710c80e92ed6e96090148914aad2277465327944b2700fee7cb4ffaf9dad4",
  "notes": "Pass-2 GLM5.3 re-audit of intel_sdvo.c. All other candidate classes killed with citations (see VERDICT.md): user-controlled enum indexing gated by drm_property_change_valid_get on every ioctl path (drm_mode_object.c:436, drm_atomic_uapi.c:932,1347; drm_property.c:923); device status byte indexing bounded (intel_sdvo.c:560); TV format/scale tables bounded by TV_FORMAT_NUM/ARRAY_SIZE; HDTV-only format map edge benign (0-value enum property rejects all userspace values); only division guarded (intel_sdvo.c:1491); ddc_bus mutation serialized by connection_mutex (drm_probe_helper.c:408); no connector-state type confusion possible (state pre-installed, no .reset, kmemdup duplicates); i2c proxy lock protocol correct; partial response fills never consumed on failure; LVDS fixed-mode derefs all IS_LVDS-guarded; probe/HPD ordering safe (hpd_pin set after output_setup); no known intel_sdvo CVE carried. code_hash = sha256(probe.sh) = 205710c80e92ed6e ; faultinject.diff sha256 = 1b00f29b... ; fix.diff sha256 = 6ef0d69a...",
  "recommended_fix": "Free the installed connector state with drm_atomic_helper_connector_destroy_state() before kfree(intel_sdvo_connector) at all four intel_sdvo_connector_init() failure sites (see fix.diff).",
  "fix_status": "not_testable",
  "fix_baseline_reproduced": 0,
  "fix_patched_reproduced": 0,
  "fix_verdict": "fix.diff (4 hunks) is git apply --check clean against the pristine sys/ tree and uses drm_atomic_helper_connector_destroy_state() (drm_atomic_helper.c:3930), already the drivers .atomic_destroy_state op (intel_sdvo.c:2234); on a fresh kzallocd, never-exposed state it is exactly kfree(state). Behavioral validation requires Intel SDVO hardware (faultinject.diff + fix.diff on real HW: leak print disappears); not testable on the QEMU guest (no Intel GPU), so fix_status=not_testable.",
  "fix_evidence": "findings/poc/DF-3913/fix.diff (git apply --check OK); VERDICT.md Fix validation section"
}