{
  "status": "untested",
  "impact": "none",
  "confidence": "certain",
  "verdict": "wal_add (intel_workarounds.c:604-618) overwrites wal->list after memcpy without kfree of the old buffer, so every 16-entry growth step leaks the previous kmalloc; additionally no code path ever frees gt_wa_list/engine->wa_list. Dormant today: largest in-tree list is 9 entries (ICL GT), so the growth path never runs; leak-per-device-cycle only if lists grow past 16 or DRM device is destroyed/re-created. Info severity hardening.",
  "exploit_chain": "",
  "evidence": "VERDICT.md; intel_workarounds.c:604-618; grep shows no kfree of any i915_wa_list in sys/dev/drm/i915/",
  "kernel_refs": [
    "sys/dev/drm/i915/intel_workarounds.c:607",
    "sys/dev/drm/i915/intel_workarounds.c:614",
    "sys/dev/drm/i915/intel_workarounds.c:617"
  ],
  "notes": "Dormant (no list >16 entries in-tree). Compiled-in DRM makes teardown leak theoretical.",
  "recommended_fix": "kfree(wal->list) after the memcpy in wal_add (see fix.diff); ideally add intel_wa_list_free() at device teardown.",
  "finding_id": "DF-4417",
  "reproduced": 0,
  "poc_changes": "No runnable PoC authored (hardware-dependent path); source-trace verification only.",
  "attempts": 0,
  "guest_uname": null,
  "runtime_sec": 0,
  "guest_dirty": 0,
  "build_cmd": null,
  "run_cmd": null,
  "code_hash": null,
  "fix_status": "not_testable",
  "fix_baseline_reproduced": 0,
  "fix_patched_reproduced": 0,
  "fix_verdict": "Fix validation not performed: no triggering hardware (Intel gen10/11 GPU / 82541 NIC) exists in the audit QEMU guest; fix.diff authored from line-accurate source analysis only.",
  "fix_evidence": "Fix validation not performed: no triggering hardware (Intel gen10/11 GPU / 82541 NIC) exists in the audit QEMU guest; fix.diff authored from line-accurate source analysis only."
}