DF-4264 evidence pack — verdict
===============================

Reproduced?  NOT at runtime — hardware-gated (no AMD GPU on the audit
guest, /dev/dri absent — env.txt/run.log).
Defect:     PROVEN at code level (certain): one dma_fence reference
            leaked per invalid AMDGPU_FENCE_TO_HANDLE ioctl.

Proof chain
-----------
1. `amdgpu_cs_fence_to_handle_ioctl()` (amdgpu_cs.c:1417-1471) obtains a
   reference: :1427 `fence = amdgpu_cs_get_fence(adev, filp,
   &info->in.fence);` — `amdgpu_cs_get_fence()` (:1391-1415) returns the
   fence from `amdgpu_ctx_get_fence()` which does `dma_fence_get(...)`
   (amdgpu_ctx.c:489).
2. Switch on `info->in.what` (:1431):
   - GET_SYNCOBJ / GET_SYNCOBJ_FD / GET_SYNC_FILE_FD all reach a
     `dma_fence_put(fence)` on every exit path (:1434, :1443, :1453,
     :1458).
   - `default:` (:1468-1470) is `return -EINVAL;` with NO put.
3. Therefore each call with `what` ∉ {0,1,2} drops one reference on the
   floor.  The leaked fence keeps a `drm_sched_fence` slab object (and
   its scheduled/finished fence pair + parent chain) alive forever.
   Looping the ioctl is an unbounded kernel-memory leak (Low severity:
   slow, ~hundreds of bytes per call, but zero-cost and silent).
4. Reachability: DRM_AUTH|DRM_RENDER_ALLOW (amdgpu_kms.c:1202) — any
   local user with the render node; the fence must be valid (a real
   submitted seq), which the PoC sets up with one minimal GFX CS.

Guest verification performed
----------------------------
- trigger compiles (build.log); runs to the hardware gate (run.log)
- baseline + patched in-tree compile rc=0 with -Werror
  (kmod_baseline_build.log / fix_build.log; fix hunk at :1466)

Exploit chain: none beyond memory exhaustion.

Recommended fix: put the reference in the default case (fix.diff).

## Fix status (batch validation)
Applied with the 36 sibling fix.diffs of this batch in findings/poc/_batch41/all_fixes.patch; single in-guest `make -j6 nativekernel KERNCONF=X86_64_GENERIC` completed RC=0 with zero errors under -Werror (full log: findings/poc/_batch41/fix_build8.log). Behavior A/B intentionally skipped for this Info-tier item.