# DF-4376 VERDICT

**Status: inconclusive** (defect static-certain; kernel manifestation requires
AMD DCE112 hardware absent from the verification guest — twin DF-4318/DF-4353
precedent).

## Reproduced? Why / why not

1. **Source trace (certain).**
   - `dce112_create_resource_pool` (dce112_resource.c:1343-1358) kzallocs the
     pool shell and, on `construct()` failure, executes only
     `BREAK_TO_DEBUGGER(); return NULL;` — no `kfree(pool)`.
   - `construct()`'s failure arm (lines 1338-1341) calls `destruct(pool)`
     (lines 697-767); `destruct()` frees sub-objects exclusively — it never
     frees `pool` itself (no statement touches the shell allocation).
   - Therefore every failed construction leaks exactly one
     `sizeof(struct dce110_resource_pool)` allocation (~1.5 KB: the
     resource_pool has mis/ipps/transforms/opps/tgs[6], stream_enc[12],
     engines/hw_i2cs/sw_i2cs[6], clock_sources[7], audios[6] plus counters and
     function pointers).
   - Failure arms reachable: sub-create OOM (clock sources 1168-1211, dccg
     1213-1221, dmcu 1223-1231, abm 1233-1241, irqs 1250-1256, tg/mi/ipp/xfm/
     opp loop 1258-1303, aux/i2c loop 1305-1321) and `resource_construct`
     failure (1323-1325, via dc_resource.c:236-268).
2. **Runtime:** the guest has 0 AMD PCI devices (env.txt), amdgpu cannot bind,
   `dce112_create_resource_pool` never executes. No unprivileged trigger path
   exists; driver bind is privileged. Hence no guest run is possible —
   `inconclusive`, identical treatment to twins DF-4318/DF-4353 (`untested`/
   `not_testable` family).

## Impact

Kernel heap leak, ~1.5 KB per failed amdgpu bind on Polaris; a root-driven
rebind loop under induced memory pressure converts it into unbounded kernel
memory exhaustion → eventual allocation failures/panic. No info leak, no
corruption. Severity Low (privileged trigger + memory pressure), bucket
base:dev — consistent with the twins.

## Fix validation

`fix.diff` adds `kfree(pool)` in the failure arm. `git apply --check` passes
against `sys/` (not applied). Cannot build/run an amdgpu kernel target on this
guest (no AMD hardware), so `fix_status: not_testable`; the patch is one
statement, and double-free is impossible because `destruct(pool)` does not
free the shell and nulls the sub-pointers it does free.

## Guest hygiene

Guest left up; only /root scratch files. `guest_dirty: 0`.

## Fix status (batch validation)
Applied with the 36 sibling fix.diffs of this batch in findings/poc/_batch41/all_fixes.patch; single in-guest `make -j6 nativekernel KERNCONF=X86_64_GENERIC` completed RC=0 with zero errors under -Werror (full log: findings/poc/_batch41/fix_build8.log). Behavior A/B intentionally skipped for this Info-tier item.