{
  "finding_id": "DF-4436",
  "status": "untested",
  "reproduced": 0,
  "impact": "none",
  "confidence": "certain",
  "verdict": "Certain static error-path resource leak, not attacker-reachable at runtime. drm_universal_plane_init registers the plane as a mode object (drm_plane.c:193) and allocates plane->format_types (:202) BEFORE the if (WARN_ON(format_count > 64)) return -EINVAL; at :214-215, which exits without kfree(plane->format_types) and without drm_mode_object_unregister - unlike the sibling error paths at :204-208 and :228-233 which clean up. Trigger is driver-static (a driver declaring >64 plane formats at probe); no in-tree DF driver does. DFs drm_plane.c is Linux v5.0s file verbatim (verified by full diff; only drm_any_plane_has_format removed, %jx adaptation, manual DRM_MODESET_LOCK_ALL expansion), and current upstream master fixed the ordering by moving the guard before drm_mode_object_add (master drm_plane.c:386 vs :393). Untested: trigger requires a hypothetical misconfigured out-of-tree driver and a DRM device; guest has no /dev/dri. Info severity.",
  "exploit_chain": "",
  "evidence": "findings/poc/DF-4436/VERDICT.md (path:line proof + upstream v5.0-vs-DF diff + master fix location); fix.diff (applies cleanly, patch --dry-run verified)",
  "kernel_refs": [
    "sys/dev/drm/drm_plane.c:193",
    "sys/dev/drm/drm_plane.c:202",
    "sys/dev/drm/drm_plane.c:214"
  ],
  "poc_changes": "No PoC authored: trigger is driver-static misconfiguration; no in-tree driver trips it and guest has no DRM device",
  "attempts": 0,
  "guest_uname": "DragonFly dfbsd 6.5-DEVELOPMENT DragonFly 6.5-DEVELOPMENT #0: Thu Jul  2 06:02:54 UTC 2026 root@dfbsd:/usr/obj/usr/src/sys/X86_64_GENERIC x86_64",
  "runtime_sec": 0,
  "guest_dirty": 0,
  "build_cmd": "",
  "run_cmd": "",
  "code_hash": "",
  "notes": "Upstream-inherited from Linux v5.0; modern upstream already fixed via the __drm_universal_plane_init refactor. Related latent hardening note (not filed separately): the format_modifiers walk at drm_plane.c:218-220 runs to the DRM_FORMAT_MOD_INVALID sentinel with no bound - a non-terminated driver array overreads kernel memory at probe (upstream-identical, driver-static).",
  "recommended_fix": "Move the format_count>64 guard above drm_mode_object_add and the format_types allocation, as current upstream does",
  "fix_status": "not_applicable",
  "fix_baseline_reproduced": 0,
  "fix_patched_reproduced": 0,
  "fix_verdict": "No behavior validation possible (no triggering driver, no DRM device in guest); fix.diff reproduces modern upstreams ordering exactly and applies cleanly (patch -p1 --dry-run OK)",
  "fix_evidence": "findings/poc/DF-4436/fix.diff (patch -p1 --dry-run: OK)"
}