{
  "finding_id": "DF-4206",
  "status": "untested",
  "reproduced": 0,
  "impact": "none",
  "confidence": "certain",
  "verdict": "Bug existence certain from source trace: when the PREFERRED-mode drm_mode_duplicate fails (kernel OOM) after drm_connector_init already registered the connector (drm_connector.c:208 IDR, :258 connector_list), vlv_dsi_init jumps to err (vlv_dsi.c:1860-1863 -> :1875-1878) and kfrees intel_connector without drm_connector_cleanup, leaving a dangling pointer on dev->mode_config.connector_list and a live id in the mode-object IDR. Post-trigger, unprivileged MODE_GETRESOURCES/MODE_GETCONNECTOR and drm_mode_config_cleanup at unload walk/put the freed connector (UAF read/write; guaranteed unload crash). Not verified on the guest: no Intel GPU on the audit VM and the trigger is OOM-gated, so Phase V is skipped per contract (Low severity). Distinct from DF-1446 (dsi_hosts leak on the same label - different object class and impact).",
  "exploit_chain": "",
  "evidence": "README.md and VERDICT.md in this pack; decisive lines: vlv_dsi.c:1839 (drm_connector_init), :1848 (attach), :1851-1857 (mode dup), :1860-1863 (goto err), :1875-1878 (kfree without cleanup); drm_connector.c:208 (IDR add), :258 (list_add_tail), :375-422 (what cleanup should have done).",
  "kernel_refs": [
    "sys/dev/drm/i915/vlv_dsi.c:1839",
    "sys/dev/drm/i915/vlv_dsi.c:1860",
    "sys/dev/drm/i915/vlv_dsi.c:1875",
    "sys/dev/drm/drm_connector.c:208",
    "sys/dev/drm/drm_connector.c:258",
    "sys/dev/drm/drm_connector.c:375"
  ],
  "poc_changes": "No PoC authored: trigger is a kzalloc failure inside drm_mode_duplicate during DSI init on real hardware; audit guest has no Intel GPU. Static proof of path only.",
  "attempts": 0,
  "guest_uname": null,
  "runtime_sec": 0,
  "guest_dirty": 0,
  "build_cmd": null,
  "run_cmd": null,
  "code_hash": null,
  "notes": "Pass-2 finding on the error path DF-1446 already touched; this is the connector lifetime defect (CWE-416), not the host/device leak (CWE-401). Upstream Linux of the same vintage has the identical shape (goto err after drm_connector_init).",
  "recommended_fix": "Add an err_connector label calling drm_connector_cleanup(connector) before the existing err cleanup, and route the !fixed_mode branch to it (fix.diff).",
  "fix_status": "not_applicable",
  "fix_baseline_reproduced": 0,
  "fix_patched_reproduced": 0,
  "fix_verdict": "No kernel-build fix validation performed: Low-severity OOM-gated finding, guest lacks Intel GPU; fix.diff is a two-hunk label addition whose correctness is checkable by inspection against drm_connector_cleanup (drm_connector.c:375-422).",
  "fix_evidence": "fix.diff (err_connector label + rerouted goto); not built or applied to sys/."
}