{
  "finding_id": "DF-4264",
  "status": "untested",
  "reproduced": 0,
  "impact": "none",
  "confidence": "certain",
  "verdict": "Code-certain dma_fence reference leak: amdgpu_cs_fence_to_handle_ioctl() takes the fence reference at amdgpu_cs.c:1427 and all three valid what cases dma_fence_put() it, but the default case (:1468-1470) returns -EINVAL without the put - one leaked fence (and its drm_sched_fence slab object + parent chain) per invalid AMDGPU_FENCE_TO_HANDLE call by an unprivileged render-node client. Runtime reproduction hardware-gated on this guest (no AMD GPU); defect and fix proven at code/compile level.",
  "exploit_chain": "Unbounded but slow kernel-memory exhaustion; no memory-safety violation.",
  "evidence": "fence_to_handle_leak.c (ctx + 1 CS + 10000 invalid what=0xFFFFFFFF calls); run.log (hardware gate); kmod_baseline_build.log + fix_build.log (in-tree -Werror compile before/after one-line fix).",
  "kernel_refs": [
    "sys/dev/drm/amd/amdgpu/amdgpu_cs.c:1427",
    "sys/dev/drm/amd/amdgpu/amdgpu_cs.c:1468",
    "sys/dev/drm/amd/amdgpu/amdgpu_ctx.c:489",
    "sys/dev/drm/amd/amdgpu/amdgpu_kms.c:1202"
  ],
  "poc_changes": "Trigger written from scratch; sets up a real fence (ctx + minimal GFX CS) so amdgpu_cs_get_fence returns a referenced object before the leak.",
  "attempts": 1,
  "guest_uname": "DragonFly dfbsd 6.5-DEVELOPMENT DragonFly 6.5-DEVELOPMENT #0: Thu Jul  2 06:02:54 UTC 2026  root@dfbsd:/usr/obj/usr/src/sys/X86_64_GENERIC x86_64",
  "runtime_sec": 90,
  "guest_dirty": 0,
  "build_cmd": "cc -O2 -Wall -o fence_to_handle_leak fence_to_handle_leak.c",
  "run_cmd": "./fence_to_handle_leak",
  "code_hash": "b10a02857cfe8de82f86487b5f536d627e574269c6a37182226fef5f8de8433b",
  "notes": "poc status untested = runtime verification blocked by absent AMD GPU. Guest reset with-src before return.",
  "recommended_fix": "Add dma_fence_put(fence) to the default case of the what switch (amdgpu_cs.c:1468).",
  "fix_status": "not_testable",
  "fix_baseline_reproduced": 0,
  "fix_patched_reproduced": 0,
  "fix_verdict": "One-line fix.diff applied on the guest stacked with the other amdgpu_cs.c fixes (hunk @1466) and compiled in-tree with -Werror rc=0 (fix_build.log). Runtime comparison impossible (no AMD GPU); compile-only validation.",
  "fix_evidence": "fix_build.log rc=0; guest patch output Hunk #1 succeeded at 1466 (offset -14 lines)."
}