{
  "finding_id": "DF-4302",
  "status": "reproduced",
  "reproduced": 1,
  "impact": "dos",
  "confidence": "certain",
  "verdict": "Reproduced live: vkbd_dev_clone() consumes a devfs clone unit on every /dev/vkbdctl open (vkbd.c:225, unbounded limit) and vkbd_dev_close() never calls devfs_clone_bitmap_put() \u2014 1000 fully-closed open/write/close cycles advanced the allocator to unit 117699 (cumulative ~116.7k units burned on the boot, ~90k within ~6 minutes at ~250 cycles/s). Permanent, unbounded kernel resource-number leak on the devices normal lifecycle; unit numbers never reused; bitmap grows forever.",
  "exploit_chain": "",
  "evidence": "run.log (before=-1, after 1000 closed cycles next unit=117699); env.txt documents the earlier cumulative hammer; trigger vkbd_unit_leak.c",
  "kernel_refs": [
    "sys/dev/misc/vkbd/vkbd.c:225",
    "sys/dev/misc/vkbd/vkbd.c:328",
    "sys/vfs/devfs/devfs_helper.c:221"
  ],
  "poc_changes": "n/a \u2014 written fresh for this verification",
  "attempts": 1,
  "guest_uname": "DragonFly dfbsd 6.5-DEVELOPMENT DragonFly 6.5-DEVELOPMENT #0: Thu Jul  2 06:02:54 UTC 2026 root@dfbsd:/usr/obj/usr/src/sys/X86_64_GENERIC x86_64",
  "runtime_sec": 12,
  "guest_dirty": 1,
  "fix_status": "untested",
  "fix_baseline_reproduced": 1,
  "fix_patched_reproduced": 0,
  "fix_verdict": "One-line put added in close (fix.diff); kernel not rebuilt for this Low non-corruption finding \u2014 fix validated by inspection (bitmap has no other consumer; put is the documented devfs pattern, devfs_core.c:2672)",
  "fix_evidence": "fix.diff",
  "build_cmd": "cc -O2 -o vkbd_unit_leak vkbd_unit_leak.c",
  "run_cmd": "kldload vkbd && ./vkbd_unit_leak",
  "code_hash": "bb6dde21265f57b7fc253ac869b8fc8e3bdd8b264f422d291d8674f4619bac4c",
  "notes": "Impact classified dos (resource exhaustion class) at Low severity: root-only device (0600), leak is of unit-number space + small bitmap memory, but unbounded and permanent per boot.",
  "recommended_fix": "devfs_clone_bitmap_put(&DEVFS_CLONE_BITMAP(vkbd), dev2unit(dev)) in vkbd_dev_close()."
}