# VERDICT — DF-4318

**Status: untested (kernel path) / model-logic-confirmed (guest)**
**Impact: none on this guest (hardware-gated); code defect certain**

## Reproduced?

Not against the kernel: the trigger needs an AMD DCE8-class (Sea Islands /
Bonaire / Kaveri / Kabini) dGPU driven by amdgpu, plus a failure inside
`dce80_construct()`. The audit guest (`DragonFly dfbsd 6.5-DEVELOPMENT`,
X86_64_GENERIC) has **no AMD GPU** — `pciconf -l` shows only QEMU hostbridge,
IDE, virtio-net/blk and a generic VGA (0x11111234). `amdgpu.ko` exists in
`/boot/kernel` but can never bind.

What *was* verified, on the guest:

1. **Control-flow model proof** (`df4318.c`, exact copy of the three-function
   flow) built with the guest's `cc 8.3 [DragonFly]` and run: the failure
   path ends with exactly one orphaned allocation (the pool) while
   `destruct()` reclaimed the children; the success path ends at zero live
   allocations. Output in `run.log` / `build_and_run.log`.

2. **Line-by-line trace** (static, cited):
   - `dce80_resource.c:1052-1067` — `pool = kzalloc(...)`;
     `if (dce80_construct(...)) return &pool->base;` … `return NULL;`
     — **no `kfree(pool)`** on the failure arm. Same shape at
     `:1262-1277` (dce81) and `:1468-1483` (dce83).
   - `dce80_resource.c:1047-1049` — construct failure runs `destruct(pool)`
     (`:726-796`) which frees only the sub-objects (opps/transforms/ipps/mis/
     tgs/engines/i2cs/stream_encs/clk_srcs/abm/dmcu/dccg/irqs/audios), never
     `pool`.
   - Caller `core/dc.c:671-677` (`dc_construct`): on NULL it does
     `goto fail; destruct(dc)` — it never received the pointer, so nothing
     can free the orphan.

## Trigger conditions (when hardware exists)

Any of, during `amdgpu` bind/hotplug:
- sub-object `kzalloc` failure (OOM): tg (:974), mi (:982), ipp (:989),
  transform (:996), opp (:1003), aux engine (:1012), hw i2c (:1019),
  sw i2c (:1026), dccg (:931), dmcu (:941), abm (:951), clock sources
  (:895-914), dp clock source (:917)
- `dal_irq_service_dce80_create` failure (:968-970)
- `resource_construct` failure (audio create fail — dc_resource.c:235-238 —
  or virtual stream encoder fail — dc_resource.c:267-270)

Each failed bind leaks `sizeof(struct dce110_resource_pool)` (~1-2 KB:
embedded `resource_pool` with 6/6/6/6/6/12/6/6/6/7/6 pointer arrays +
dce110 members). Rebind/hotplug loops under memory pressure amplify it.
No privilege boundary is crossed — this is a hardening-class leak.

## Exploit chain

None (CWE-401 leak, not corruption). Ceiling: unbounded kernel heap
consumption over repeated failing attaches on the affected GPU.

## Fix validation

`fix.diff` adds `kfree(pool)` to the three failure arms (mirrors
`dce80_destroy_resource_pool`'s `destruct(pool); kfree(pool);` at :841-848).
Not kernel-tested: guest lacks the hardware; the model proves the logic
trivially — with the fix, failure path ends at 0 live allocations.

## Conclusion

Code defect is **certain** (dead-simple missing free, three sites). Guest
kernel-path reproduction **untested** (hardware absent). Severity Low.

## Fix status (batch validation)
Applied with the 36 sibling fix.diffs of this batch in findings/poc/_batch41/all_fixes.patch; single in-guest `make -j6 nativekernel KERNCONF=X86_64_GENERIC` completed RC=0 with zero errors under -Werror (full log: findings/poc/_batch41/fix_build8.log). Behavior A/B intentionally skipped for this Info-tier item.