{
  "finding_id": "DF-4257",
  "status": "inconclusive",
  "reproduced": 0,
  "impact": "none",
  "confidence": "certain",
  "verdict": "my_attach allocates sc->my_ldata_ptr = kmalloc(sizeof(struct my_list_data)+8, M_DEVBUF, M_WAITOK) (sys/dev/netif/my/if_my.c:870-871) and my_detach (971-992) never kfree()s it — it releases only my_irq and my_res. Every detach leaks 2056 bytes, and every failed attach (no PHY found at 936-939, bus_setup_intr failure at 955-961 — both routed to my_detach via the fail label at 966-968) leaks it too; there is no kfree of my_ldata_ptr anywhere in the driver. Root can loop kldload/kldunload for unbounded kernel heap exhaustion. Distinct allocation from the DF-1479 mbuf leak. Not executable on the audit guest: pciconf shows no 1516 device (env.txt) so my_probe never matches and my_attach never runs.",
  "exploit_chain": "",
  "evidence": "VERDICT.md (all my_ldata_ptr uses enumerated — no kfree exists); env.txt (no Myson PCI device on guest)",
  "kernel_refs": [
    "sys/dev/netif/my/if_my.c:870-871",
    "sys/dev/netif/my/if_my.c:966-968",
    "sys/dev/netif/my/if_my.c:971-992"
  ],
  "poc_changes": "trigger.sh documents the kldload/kldunload loop + vmstat -m observation for affected hardware",
  "attempts": 1,
  "guest_uname": "DragonFly dfbsd 6.5-DEVELOPMENT DragonFly 6.5-DEVELOPMENT #0: Thu Jul  2 06:02:54 UTC 2026 root@dfbsd:/usr/obj/usr/src/sys/X86_64_GENERIC x86_64",
  "runtime_sec": 5,
  "guest_dirty": 0,
  "build_cmd": "n/a",
  "run_cmd": "./trigger.sh (requires Myson NIC)",
  "notes": "attach-failure variant is reachable without root only via hardware state (PCI id present, PHY dead); unload loop is root-driven.",
  "recommended_fix": "kfree(sc->my_ldata_ptr, M_DEVBUF) in my_detach before releasing resources",
  "fix_status": "not_testable",
  "fix_baseline_reproduced": 0,
  "fix_patched_reproduced": 0,
  "fix_verdict": "one-line kfree added in my_detach (fix.diff); hardware-gated, not validated on this guest",
  "fix_evidence": "findings/poc/DF-4257/fix.diff"
}