{
  "finding_id": "DF-4397",
  "status": "untested",
  "reproduced": 0,
  "impact": "none",
  "confidence": "certain",
  "verdict": "Source-certain kernel-heap leak: vega10_pp_tables_uninitialize (vega10_processpptables.c:1183-1228) frees only the original 9 allocations while the parser now creates ~17 \u2014 vdd_dep_on_socclk, vdd_dep_on_dcefclk, vdd_dep_on_pixclk, vdd_dep_on_phyclk, vdd_dep_on_dispclk, pcie_table, valid_socclk_values, valid_dcefclk_values (allocated at :926/:954/:936/:942/:948/:964/:986/:1000) are leaked on every teardown/re-init cycle, i.e. once per /sys pp_table write (root, amdgpu_pm.c:1007 -> amd_powerplay.c:676 -> hwmgr.c:261-281) and once per rebind/module-reload. Unbounded kernel-heap growth from a privileged trigger (CWE-401); Low severity. Runtime reproduction hardware-gated (no AMD ASIC on guest); fix.diff adds the 8 missing kfree pairs, git apply --check clean, patched file 0 syntax errors on the guest kernel toolchain.",
  "exploit_chain": "",
  "evidence": "VERDICT.md alloc-vs-free table (path:line for all 8 leaked allocations); fix.diff (git apply --check OK); build.log (0 syntax errors, guest kernel toolchain)",
  "kernel_refs": [
    "sys/dev/drm/amd/powerplay/hwmgr/vega10_processpptables.c:1183",
    "sys/dev/drm/amd/powerplay/hwmgr/vega10_processpptables.c:926",
    "sys/dev/drm/amd/powerplay/hwmgr/vega10_processpptables.c:954",
    "sys/dev/drm/amd/powerplay/hwmgr/vega10_processpptables.c:964",
    "sys/dev/drm/amd/powerplay/hwmgr/vega10_processpptables.c:986",
    "sys/dev/drm/amd/powerplay/hwmgr/vega10_hwmgr.c:787",
    "sys/dev/drm/amd/powerplay/amd_powerplay.c:676",
    "sys/dev/drm/amd/amdgpu/amdgpu_pm.c:1007"
  ],
  "poc_changes": "authored fresh this run (pass 2); no seed PoC",
  "attempts": 1,
  "guest_uname": "DragonFly dfbsd 6.5-DEVELOPMENT DragonFly 6.5-DEVELOPMENT #0: Thu Jul  2 06:02:54 UTC 2026  root@dfbsd:/usr/obj/usr/src/sys/X86_64_GENERIC x86_64",
  "runtime_sec": 120,
  "guest_dirty": 0,
  "build_cmd": "./build_check.sh (guest cc -fsyntax-only, kernel includes)",
  "run_cmd": "static alloc-vs-free set difference (VERDICT.md)",
  "code_hash": "49cbad62764d6d72d12c923d68d1b6b2c8a35fdb7081856c86fbbd84e2a9d170",
  "notes": "Low-severity finding: contract permits skipping Phase V for Low; done cheaply anyway (compile validation only). Status untested = device absent (contracts not_testable class).",
  "recommended_fix": "free the 8 remaining subtable pointers in vega10_pp_tables_uninitialize (fix.diff)",
  "fix_status": "not_testable",
  "fix_baseline_reproduced": 0,
  "fix_patched_reproduced": 0,
  "fix_verdict": "not_testable at runtime (no AMD ASIC on guest); fix.diff compile-validated on the guest kernel toolchain (0 syntax errors).",
  "fix_evidence": "fix.diff; build.log",
  "fix_kernel_uname": "DragonFly dfbsd 6.5-DEVELOPMENT #0 x86_64 (syntax validation only)"
}