# DF-4376 — dce112_create_resource_pool leaks the pool allocation on construct() failure (DF-4318/DF-4353 twin)

## What

`sys/dev/drm/amd/display/dc/dce112/dce112_resource.c:1343-1358`:

```c
struct resource_pool *dce112_create_resource_pool(
	uint8_t num_virtual_links,
	struct dc *dc)
{
	struct dce110_resource_pool *pool =
		kzalloc(sizeof(struct dce110_resource_pool), GFP_KERNEL);

	if (!pool)
		return NULL;

	if (construct(num_virtual_links, dc, pool))
		return &pool->base;

	BREAK_TO_DEBUGGER();
	return NULL;                     /* <-- pool never freed */
}
```

On failure, `construct()`'s `res_create_fail` arm (lines 1338-1340) runs
`destruct(pool)` (lines 697-767), which frees only the *sub-objects* (opps,
transforms, ipps, mis, tgs, engines, i2cs, stream_encs, clock_sources, audios,
abm, dmcu, dccg, irqs) — never the pool shell itself. The caller (DC core)
received NULL and cannot free what it never got. `sizeof(struct
dce110_resource_pool)` ≈ 1.5 KB (resource_pool: ~100 pointers + counters +
func tables) leaks per failed attempt.

## Trigger path

`construct()` fails when any of its ~40 sub-allocations fails (GFP_KERNEL
kzallocs under memory pressure), when `dal_irq_service_dce110_create` fails
(line 1253-1255), or when `resource_construct()` fails (audio/virtual stream
encoder creation, dc_resource.c:236-268). Each amdgpu bind attempt on a
DCE112 (Polaris 10/11) ASIC that hits a failure leaks one pool. Driver
(re)bind is a root operation, so the leak accrues under root-driven reprobe
loops or repeated failed binds at boot with persistent memory pressure.

## Reproduce

Kernel reproduction requires an AMD Polaris GPU: the verification guest has
none (`env.txt`: `pciconf -l` shows only QEMU/virtio devices, 0 AMD devices),
so `dce112_create_resource_pool` cannot execute there. The defect is
static-certain: the failure arm provably returns without kfree, and `destruct()`
provably never frees the shell (it only touches `pool->base.*` members). This
is the exact twin of accepted DF-4318 (dce80/81/83) and DF-4353 (dce110);
upstream Linux carries the same leak today.

No buildable trigger exists for this guest; `build.sh`/`run.sh` record the
env-probe that establishes non-testability.

## Fix

`fix.diff` — add `kfree(pool)` in the failure arm (destruct already ran, so
the shell free is the only missing piece; cannot double-free). 
`git apply --check` clean against `sys/`.