{
  "finding_id": "DF-4420",
  "status": "untested",
  "reproduced": 0,
  "impact": "none",
  "confidence": "certain",
  "verdict": "oce_mq_create() creates its completion queue first but assigns mq->cq only on the success path (oce_queue.c:744), so when oce_create_ring_buffer (oce_queue.c:689-691) or the CREATE_MQ_EXT mailbox command (oce_queue.c:735-741) fails, oce_mq_free() skips its cq cleanup because mq->cq is still NULL \u2014 the cq struct plus its CQ_LEN_256 DMA ring leaks and sc->cq[ncqs-1] keeps a pointer to it. Pure resource leak on a real-hardware attach failure path: no unprivileged or network reachability, no UAF (nothing iterates sc->cq[] after release). Not runnable on the verification guest (no Emulex 0x19a2 PCI device), and Info-severity findings are PoC-exempt per contract; root cause proven by line-accurate goto-path trace.",
  "exploit_chain": "",
  "evidence": "findings/poc/DF-4420/VERDICT.md (goto-path table for all four failure paths of oce_mq_create); findings/poc/DF-4420/env.txt (guest has no oce hardware); sys/dev/netif/oce/oce_queue.c:675-678, 689-691, 735-741, 744, 779-803",
  "kernel_refs": [
    "sys/dev/netif/oce/oce_queue.c:675",
    "sys/dev/netif/oce/oce_queue.c:689",
    "sys/dev/netif/oce/oce_queue.c:735",
    "sys/dev/netif/oce/oce_queue.c:744",
    "sys/dev/netif/oce/oce_queue.c:796"
  ],
  "poc_changes": "no runnable PoC exists for this class (hardware mailbox failure path); evidence is the static path trace in VERDICT.md",
  "attempts": 0,
  "guest_uname": "DragonFly dfbsd 6.5-DEVELOPMENT DragonFly 6.5-DEVELOPMENT #0: Thu Jul  2 06:02:54 UTC 2026 root@dfbsd:/usr/obj/usr/src/sys/X86_64_GENERIC x86_64",
  "runtime_sec": 0,
  "guest_dirty": 0,
  "build_cmd": "n/a (no oce hardware on guest; error path unreachable)",
  "run_cmd": "n/a (no oce hardware on guest; error path unreachable)",
  "code_hash": "sha256 of fix.diff: see manifest.json",
  "fix_status": "not_testable",
  "fix_baseline_reproduced": 0,
  "fix_patched_reproduced": 0,
  "fix_verdict": "fix.diff moves mq->cq = cq up to immediately after the cq creation so oce_mq_free()s existing cleanup covers every error path; diff is patch(1)-validated against the pristine file (applies clean, see VERDICT.md). Kernel build/behavior validation impossible on the guest: no Emulex OneConnect device, so neither baseline nor patched behavior is exercisable.",
  "fix_evidence": "findings/poc/DF-4420/fix.diff (validated with patch --dry-run against pristine oce_queue.c)",
  "notes": "Reserved-ID batch DF-4420..DF-4431; only DF-4420 used. Also confirmed in this pass and NOT re-reported: DF-1601 (kbdmux), DF-4079..DF-4082 (oce_if.c). Cross-file observations recorded in the result block negative_notes: oce_wq_handler device-trusted wqe_index cidx arithmetic (oce_if.c, already covered by that files own passes), genkbd_get_fkeystr off-by-one (kbd.c, root-only keymap loading).",
  "recommended_fix": "In oce_mq_create, set mq->cq = cq immediately after oce_cq_create succeeds so oce_mq_free releases the CQ on all error paths."
}