[DF-4007 BASELINE] move_to_active fails at index 1 (BASELINE)
    vma[0] objA  pin=-1 fence=-1 objrefs=2  <-- FENCE PIN UNDERFLOW (fence freed while vma still fenced)
    vma[1] shadow pin=0 fence=0 objrefs=2
    vma[2] objC  pin=0 fence=0 objrefs=2

[DF-4007 BASELINE] move_to_active fails at index 2 (BASELINE)
    vma[0] objA  pin=-1 fence=-1 objrefs=2  <-- FENCE PIN UNDERFLOW (fence freed while vma still fenced)
    vma[1] shadow pin=-1 fence=0 objrefs=1  <-- OBJ REF UNDERFLOW (premature GEM object free -> UAF)
    vma[2] objC  pin=0 fence=0 objrefs=2

[DF-4007 control] move_to_active fails at index -1 (BASELINE)
    vma[0] objA  pin=0 fence=0 objrefs=2
    vma[1] shadow pin=0 fence=0 objrefs=2
    vma[2] objC  pin=0 fence=0 objrefs=2

[DF-4007 PATCHED ] move_to_active fails at index 2 (PATCHED)
    vma[0] objA  pin=0 fence=0 objrefs=2
    vma[1] shadow pin=0 fence=0 objrefs=2
    vma[2] objC  pin=0 fence=0 objrefs=2

----
open(/dev/dri/renderD128): No such file or directory — no DRM device on this guest (virtio GPU only)
DF-4007 runtime trigger requires an Intel i915 device; see model_df4007.c for the demonstrated control-flow proof.
poc exit=77