# DF-4417 — i915: `wal_add()` leaks prior W/A list buffer on growth; no teardown free

- **File**: sys/dev/drm/i915/intel_workarounds.c:604-618
- **Severity**: Info · **CWE**: CWE-401 · **Confidence**: certain (defect), dormant today
- **Status**: untested — growth path (>16 W/A entries in one list) is not taken
  by any in-tree platform (max = 9, ICL GT list).

## Build / Run / Expected
Static defect. To exercise: extend any *_gt_workarounds_init() past 16 entries
and observe the kmalloc'd buffer from the previous growth step being leaked at
`wal->list = list;`. fix.diff adds the missing kfree. See VERDICT.md.

## Artifacts
VERDICT.md · verdict.json · fix.diff · manifest.json