# DF-4206 VERDICT

**Status: untested (Phase V skipped — Low severity, OOM-gated trigger, no
Intel GPU on the audit guest). Bug existence: certain, proven from source.**

## Reproduced?

Not on the guest: the QEMU audit VM has no Intel GPU (i915 never attaches,
`vlv_dsi_init` unreachable), and the trigger requires a kzalloc failure
inside `drm_mode_duplicate` during DSI connector init on real hardware.
Source-level trace is complete and unambiguous (below), so bug existence is
rated **certain**; runtime impact untested.

## The chain, with citations

* Registration: `drm_connector_init` puts the connector in the mode-object
  IDR (drm_connector.c:208 `__drm_mode_object_add`) and on
  `dev->mode_config.connector_list` (drm_connector.c:258 `list_add_tail`).
* Faulting flow: vlv_dsi.c:1839 (init) → :1848 (attach encoder) → :1851
  (`intel_dsi_vbt_get_modes`, adds PREFERRED mode) → :1852-1857 (second
  duplicate into `fixed_mode`) → :1860-1863 `goto err` when the duplicate
  fails → :1875-1878 `kfree(intel_dsi); kfree(intel_connector)` with **no**
  `drm_connector_cleanup`.
* Post-free use (unprivileged): MODE_GETRESOURCES walks connector_list;
  MODE_GETCONNECTOR resolves the stale IDR id (`drm_mode_object_find`);
  `drm_mode_config_cleanup` at unload does `drm_connector_put` on the freed
  entry (refcount write to freed memory).
* Secondary leaks on the same path: `connector->name` (drm_connector.c:236)
  and probed modes (drm_connector.c:392-396 would have freed them).

## Impact ceiling

Use-after-free of a driver-owned `intel_connector` reachable through plain
DRM ioctls *after* the OOM-gated trigger fires during attach; guaranteed
crash at driver unload (drm_connector_put on freed memory). No escalation
chain developed: the trigger cannot be scheduled by an unprivileged user,
and the freed object is small driver state. Low severity.

## Fix validation

Not performed on the guest (no hardware). By inspection, the
`err_connector` label calling `drm_connector_cleanup(connector)` exactly
undoes steps taken after :1839: IDR unregister (:405), name free (:406),
probed-modes free (:392-393), `list_del` (:409) — leaving the earlier `err`
sites (:1811, :1818) untouched and correct.

## Relationship to DF-1446

DF-1446 (same label) is the dsi_hosts host/device leak — a CWE-401 resource
leak. DF-4206 is the connector lifetime defect — CWE-416. Different object,
different impact, complementary fix (fix.diff adds a label; DF-1446's fix
adds dsi_hosts frees).

## Fix status (batch validation)
Applied with the 36 sibling fix.diffs of this batch in findings/poc/_batch41/all_fixes.patch; single in-guest `make -j6 nativekernel KERNCONF=X86_64_GENERIC` completed RC=0 with zero errors under -Werror (full log: findings/poc/_batch41/fix_build8.log). Behavior A/B intentionally skipped for this Info-tier item.