{
  "finding_id": "DF-4378",
  "status": "not_reproduced",
  "reproduced": 0,
  "impact": "none",
  "confidence": "certain",
  "verdict": "drm_minor_free() (drm_drv.c:176-196) kfrees the drm_minor while the resources its allocation created are never released: drm_sysfs_minor_alloc() kzallocs a struct device (drm_sysfs.c:93) and make_dev()s /dev/dri/cardN (drm_sysfs.c:97) storing the cdev nowhere; put_device is #if 0 and destroy_dev appears nowhere in sys/dev/drm. Every driver attach/detach (or module load/unload) cycle leaks one cdev + one struct device per minor, and the stale /dev/dri node keeps si_drv1 (set at open, drm_file.c:497) dangling at the freed drm_device. Not user-triggerable memory corruption (post-unregister opens fail ENODEV via the idr NULL slot); privileged/hotplug-gated resource leak -> Low. Not reproduced on the audit guest: no DRM GPU, drm module not loaded (chk_drm built and ran, /dev/dri absent, exit 2).",
  "exploit_chain": "",
  "evidence": "VERDICT.md (creation vs release path:line, plus the killed-candidates list incl. dead drm_cdevpriv_dtor and balanced kgetenv/kfreeenv); run.log shows BUILD_OK_4378, /dev/dri absent, kldstat without drm, unknown oid hw.drm.",
  "kernel_refs": [
    "sys/dev/drm/drm_drv.c:158",
    "sys/dev/drm/drm_drv.c:176",
    "sys/dev/drm/drm_drv.c:186",
    "sys/dev/drm/drm_drv.c:237",
    "sys/dev/drm/drm_sysfs.c:93",
    "sys/dev/drm/drm_sysfs.c:97",
    "sys/dev/drm/drm_file.c:497"
  ],
  "poc_changes": "Probe written from scratch (no seed); added <errno.h> after first guest compile failed; guest-side b64decode used for transfer.",
  "attempts": 2,
  "guest_uname": "DragonFly dfbsd 6.5-DEVELOPMENT DragonFly 6.5-DEVELOPMENT #0: Thu Jul  2 06:02:54 UTC 2026 root@dfbsd:/usr/obj/usr/src/sys/X86_64_GENERIC x86_64",
  "runtime_sec": 25,
  "guest_dirty": 0,
  "build_cmd": "cc -o chk_drm chk_drm.c",
  "run_cmd": "./chk_drm",
  "code_hash": "496b299c27bb77f694f524ebed43279c2abbad299fe3586e3adfb51c836469a7",
  "notes": "Phase V skip-class (Low, gated on DRM driver attach which the guest lacks); reachability probe run and logged. Guest left clean (only /tmp scratch files, guest_dirty=0; no reset needed - guest stayed up throughout).",
  "recommended_fix": "Store the make_dev() cdev in struct drm_minor and destroy_dev() it plus kfree(minor->kdev) in drm_minor_free() (fix.diff: drm_drv.c + drm_file.h + drm_sysfs.c).",
  "fix_status": "not_testable",
  "fix_baseline_reproduced": 0,
  "fix_patched_reproduced": 0,
  "fix_verdict": "fix.diff authored against the read-only tree, never applied; cannot validate on the guest since no DRM driver can attach there (no GPU). Diff is minimal and compile-safe by inspection (incomplete-type cdev pointer in drm_file.h, destroy_dev via sys/conf.h).",
  "fix_evidence": "fix.diff in this pack; guest absence evidence in run.log/env.txt."
}