{
  "finding_id": "DF-4439",
  "status": "inconclusive",
  "reproduced": 0,
  "impact": "none",
  "confidence": "certain",
  "verdict": "Source-level defect is certain: drm_atomic_state_init() (drm_atomic.c:77) never drm_dev_get()s the device and __drm_atomic_state_free() (drm_atomic.c:251) never drm_dev_put()s, while nonblocking atomic commits (drm_atomic_uapi.c:1368 -> drm_atomic.c:1080 -> drm_atomic_helper.c:1745 queue_work on system_unbound_wq) release the state only from the async commit tail, after the ioctl returned \u2014 the exact UAF fixed upstream by stable-ccd Linux commit 4e076c73e4f6, whose backport (fix.diff) is absent here. Runtime reproduction on the audit guest is impossible: the QEMU std-VGA guest has no DRM device node and no port KMS driver (i915/radeon/amdgpu) attaches, verified by probe_drm.c (run.log), so the verdict is inconclusive rather than not_reproduced.",
  "exploit_chain": "On real hardware: (1) unprivileged DRM master issues DRM_IOCTL_MODE_ATOMIC with DRM_MODE_ATOMIC_NONBLOCK in a loop, keeping commit_work pending on system_unbound_wq; (2) root kldunloads the KMS driver (radeon.ko/amdgpu.ko/i915kms.ko, all modules) or any future drm_dev_unplug() caller drops the last drm_device kref; (3) commit tails drm_atomic_state_put() -> __drm_atomic_state_free() dereferences freed drm_device (state->dev->mode_config at drm_atomic.c:254) and performs an indirect call config->funcs->atomic_state_free (drm_atomic.c:261) through freed memory \u2014 UAF primitive; free side requires privilege, hence Medium.",
  "evidence": "run.log (probe: /dev/drm* and /dev/dri/* all absent on guest); VERDICT.md (full path:line chain + upstream commit match); fix.diff (backport of 4e076c73e4f6); env.txt (guest uname, no KMS driver bind)",
  "kernel_refs": [
    "sys/dev/drm/drm_atomic.c:77",
    "sys/dev/drm/drm_atomic.c:95",
    "sys/dev/drm/drm_atomic.c:251",
    "sys/dev/drm/drm_atomic.c:254",
    "sys/dev/drm/drm_atomic.c:260",
    "sys/dev/drm/drm_atomic.c:1069",
    "sys/dev/drm/drm_atomic_uapi.c:1368",
    "sys/dev/drm/drm_atomic_helper.c:1701",
    "sys/dev/drm/drm_atomic_helper.c:1745",
    "sys/dev/drm/drm_drv.c:737",
    "sys/dev/drm/drm_drv.c:761"
  ],
  "poc_changes": "No seed pack existed; wrote probe_drm.c from scratch to document DRM availability on the guest (the original race harness cannot run without hardware).",
  "attempts": 1,
  "guest_uname": "DragonFly dfbsd 6.5-DEVELOPMENT DragonFly 6.5-DEVELOPMENT #0: Thu Jul  2 06:02:54 UTC 2026 root@dfbsd:/usr/obj/usr/src/sys/X86_64_GENERIC x86_64",
  "runtime_sec": 12,
  "guest_dirty": 0,
  "build_cmd": "cc -O -o /tmp/probe_drm /root/poc/DF-4439/probe_drm.c",
  "run_cmd": "/tmp/probe_drm",
  "code_hash": "55a66879bf93893767c04ff04b4747a69cf343926097b7b9b1755d6b22d1ba25",
  "notes": "Port verified byte-equivalent to Linux v4.19 for all functions present except two cosmetic diffs (drm_atomic.c:554 %jx; drm_atomic.c:726 M_DRM krealloc). Writeback path (drm_atomic_connector_check, drm_atomic.c:393) is dead code in this port: no drm_writeback.c, prop_writeback_fb_id never created, no driver registers DRM_MODE_CONNECTOR_WRITEBACK, and the stub drm_writeback.h no-ops cleanup \u2014 so upstream 8581d51055a0 (empty-fb writeback_job) is unreachable here. 5ec1cebd5930 (affected-CRTC masks) also inapplicable: that bookkeeping does not exist in the 4.19 base.",
  "recommended_fix": "Backport Linux 4e076c73e4f6: drm_dev_get(dev) in drm_atomic_state_init() and drm_dev_put(dev) in __drm_atomic_state_free() (see fix.diff)",
  "fix_status": "not_testable",
  "fix_baseline_reproduced": 0,
  "fix_patched_reproduced": 0,
  "fix_verdict": "fix.diff is the exact backport of upstream 4e076c73e4f6; baseline-vs-patched kernel validation cannot run because the guest has no DRM device (probe_drm.c run.log).",
  "fix_evidence": "findings/poc/DF-4439/fix.diff; findings/poc/DF-4439/run.log"
}