{
  "finding_id": "DF-4437",
  "status": "untested",
  "reproduced": 0,
  "impact": "none",
  "confidence": "likely",
  "verdict": "Certain control-flow defect, latent trigger on stock DragonFly. drm_mode_page_flip_ioctl takes drm_crtc_vblank_get (drm_plane.c:1053) once, before the modeset retry loop, but the only drm_crtc_vblank_put (:1195-1196) sits AFTER the -EDEADLK goto retry (:1186-1190) and is gated on ret - so a flip that succeeds after a deadlock retry returns ret==0 and never drops the reference: one vblank refcount leak per retried flip, keeping the vblank IRQ permanently enabled and growing the CRTC refcount monotonically. Path is live only for page_flip_target drivers (radeon radeon_display.c:666, amdgpu legacy DCE amdgpu_display.c:146) and is DRM_MASTER-gated (drm_ioctl.c:673). On stock DF no in-tree path produces the required ww-lock inversion against this ioctls crtc-then-plane order (the plane-then-crtc locker drm_atomic_helper_update_plane exists only in atomic drivers, which dont carry page_flip_target), so the defect is latent today and becomes a local display DoS the day such a producer ships. Byte-identical logic in Linux v5.0 and current upstream master. Untested: guest has no DRM device (/dev/dri absent) and lacks radeon/amdgpu hardware. Low severity.",
  "exploit_chain": "",
  "evidence": "findings/poc/DF-4437/VERDICT.md (full control-flow trace + reachability analysis + upstream parity); env.txt (guest DRM absence); fix.diff (applies cleanly with 2-line offset, patch --dry-run verified)",
  "kernel_refs": [
    "sys/dev/drm/drm_plane.c:1053",
    "sys/dev/drm/drm_plane.c:1089",
    "sys/dev/drm/drm_plane.c:1186",
    "sys/dev/drm/drm_plane.c:1195",
    "sys/dev/drm/drm_ioctl.c:673",
    "sys/dev/drm/radeon/radeon_display.c:666",
    "sys/dev/drm/amd/amdgpu/amdgpu_display.c:146"
  ],
  "poc_changes": "No PoC authored: needs a page_flip_target-capable GPU (radeon/pre-DC amdgpu) plus a lock-inversion producer not shipped on DF; guest has no DRM device",
  "attempts": 0,
  "guest_uname": "DragonFly dfbsd 6.5-DEVELOPMENT DragonFly 6.5-DEVELOPMENT #0: Thu Jul  2 06:02:54 UTC 2026 root@dfbsd:/usr/obj/usr/src/sys/X86_64_GENERIC x86_64",
  "runtime_sec": 0,
  "guest_dirty": 0,
  "build_cmd": "",
  "run_cmd": "",
  "code_hash": "",
  "notes": "Upstream-inherited (identical tail in Linux v5.0 and master as of 2026-09) - worth reporting upstream. Would become a local DoS (vblank IRQ never disabled, refcount exhaustion) if a plane-before-crtc modeset locker coexists with a page_flip_target driver.",
  "recommended_fix": "Bracket the vblank reference with a vblank_ref_held flag: (re)acquire at retry-loop top when not held, release at out: before the -EDEADLK backoff decision",
  "fix_status": "not_applicable",
  "fix_baseline_reproduced": 0,
  "fix_patched_reproduced": 0,
  "fix_verdict": "No behavior validation possible (no GPU, no inversion producer in guest); fix.diff get/put-brackets every exit and retry path; applies cleanly (patch -p1 --dry-run OK, offset 2 lines)",
  "fix_evidence": "findings/poc/DF-4437/fix.diff (patch -p1 --dry-run: OK)"
}