{
  "finding_id": "DF-4195",
  "status": "untested",
  "reproduced": 0,
  "impact": "none",
  "confidence": "likely",
  "verdict": "Code-certain lifecycle defect, reachability speculative. drm_connector_register()s error unwind (sys/dev/drm/drm_connector.c:453-467) calls drm_sysfs_connector_remove(), which kfrees connector->kdev without NULLing it (sys/dev/drm/drm_sysfs.c:48-55) and leaves registration_state == INITIALIZING. A re-register would early-return on the stale non-NULL kdev (drm_sysfs.c:37) yet mark the connector REGISTERED, so the eventual unregister kfrees the dangling pointer (double free); separately drm_sysfs_connector_add() dereferences an unchecked kzalloc result (drm_sysfs.c:41-44) \u2014 NULL-deref panic under OOM at device registration/MST hotplug. Grep of every drm_connector_register() caller shows no in-tree retry after failure (register_all runs once; MST hotplug registers each connector once after creation), and the guest has no DRM device, so neither branch was exercised at runtime.",
  "exploit_chain": "",
  "evidence": "VERDICT.md (path:line walkthrough); fix.diff (kdev=NULL on remove + kzalloc/kasprintf checks); caller grep summarized in VERDICT.md; ../DF-4194/env.txt (no DRM on guest).",
  "kernel_refs": [
    "sys/dev/drm/drm_connector.c:453",
    "sys/dev/drm/drm_connector.c:467",
    "sys/dev/drm/drm_sysfs.c:37",
    "sys/dev/drm/drm_sysfs.c:41",
    "sys/dev/drm/drm_sysfs.c:48"
  ],
  "poc_changes": "No seed PoC; no runtime PoC possible (no DRM device on guest; no in-tree re-register caller).",
  "attempts": 1,
  "guest_uname": "DragonFly dfbsd 6.5-DEVELOPMENT DragonFly 6.5-DEVELOPMENT #0: Thu Jul  2 06:02:54 UTC 2026 root@dfbsd:/usr/obj/usr/src/sys/X86_64_GENERIC x86_64",
  "runtime_sec": 0,
  "guest_dirty": 0,
  "code_hash": "",
  "notes": "Low: latent API hazard hardening. The double-free requires a driver pattern absent in-tree (register retry after late_register failure); the NULL-deref requires OOM during registration.",
  "fix_status": "not_tested",
  "fix_baseline_reproduced": 0,
  "fix_patched_reproduced": 0,
  "fix_verdict": "fix.diff (NULL kdev after kfree + check both allocations in add) removes both failure modes at the source; not kernel-build validated because the guest has no DRM hardware.",
  "fix_evidence": "findings/poc/DF-4195/fix.diff",
  "recommended_fix": "In drm_sysfs_connector_remove() set connector->kdev = NULL after kfree; in drm_sysfs_connector_add() check the kzalloc/kasprintf results and return -ENOMEM."
}