== DF-3995 dc_link ddc borrowed-pointer UAF/double-free harness ==

[1] construct link->ddc (ddc_service owns ddc_pin)
    alloc  struct ddc_service           0x8004a01b8 (8 bytes)
    alloc  struct ddc                   0x8004904a0 (24 bytes)
    alloc  struct gpio pin_data         0x8004a01b0 (8 bytes)
    alloc  struct gpio pin_clock        0x8004a01a8 (8 bytes)

[2] dc_link_is_dp_sink_present with dal_ddc_open FAILURE
    (pin held open by concurrent aux/i2c engine transaction —
     i2caux/aux_engine.c:82 / i2c_hw_engine.c:190 open the same
     ddc in GPIO_MODE_HARDWARE)
    free   struct gpio (pin)            0x8004a01b0
    free   struct gpio (pin)            0x8004a01a8
    free   struct ddc                   0x8004904a0

[3] ownership check: ddc_service->ddc_pin = 0x8004904a0 == DANGLING (points at freed 0x8004904a0)

[4] subsequent DDC/AUX transaction on this connector
    AUX/DC traffic reads ddc_pin->pin_data->en -> UAF read of FREED memory at 0x8004904a0

[5] driver teardown: dal_ddc_service_destroy (owner path)
    >>> UAF: owner destroy dereferences FREED struct ddc at 0x8004904a0
        (kernel: reads pin_data/pin_clock from freed heap and
         kfrees those stale pointers -> uncontrolled double free)
    free   struct ddc_service           0x8004a01b8

== summary: UAF=YES  DOUBLE_FREE=no  UAF_DEREF=YES  (allocs=4 frees=4) ==
RUN_RC=2