# DF-4460 — PoC Verification Verdict

**File:** `sys/dev/drm/drm_gem.c` (pass 2),
`drm_gem_create_mmap_offset_size()` at drm_gem.c:566-588.
**Guest:** DragonFly 6.5-DEVELOPMENT (X86_64_GENERIC), cc 8.3.

## Verdict: INCONCLUSIVE at runtime (code defect Certain; hardening/Info)

## Root cause

```c
576:	obj->map_list.key = alloc_unr(mm->idxunr);
577:	ret = drm_ht_insert_item(&mm->offset_hash, &obj->map_list);
578:	if (ret != 0) { ... free_unr ... return ret; }   /* balanced */
583:	obj->on_map = true;
585:	return drm_vma_offset_add(dev->vma_offset_manager, &obj->vma_node,
586:				  size / PAGE_SIZE);
```

The DragonFly-side publication (unr idx + legacy offset hash) is
committed at 576-583 **before** the Linux-side `drm_vma_offset_add()`
result is known. When `drm_vma_offset_add()` fails (drm_mm insert
failure — ENOMEM/sp exhausted range after DRM_FILE_PAGE_OFFSET_SIZE is
carved out, drm_vma_manager.c:200-215), the function returns the error
but leaves:

* `obj->on_map = true` and the hash item + unr idx committed, and
* **the early-return retry hole:** a subsequent
  `drm_gem_create_mmap_offset[_size]()` sees `obj->on_map` (573-574)
  and returns **0 — reporting success while `obj->vma_node` still has
  no offset**. On the Linux `->mmap` path `drm_vma_node_offset_addr()`
  would then return 0 and callers hand userspace a bogus 0 offset; on
  the DragonFly `d_mmap_single` path the object *is* still findable
  via the legacy hash (the DF offset scheme at i915_gem.c:2647-2649
  uses `map_list.key`, not vma_node), so the user-visible effect is
  limited to the leaked idx+hash slot held until object release
  (`drm_gem_free_mmap_offset`, 529-546, self-heals via the same
  on_map flag) and the inconsistent state.

Severity: Info (resource lifetime inconsistency, self-healing leak of
a 22-bit unr idx + hash bucket per failure; no demonstrated memory
safety impact).

## Reproduction

Trigger = `drm_vma_offset_add()` failure = drm_mm range exhaustion /
ENOMEM inside GEM offset creation — not injectable on the QEMU guest
(no drm hardware; no fault-injection knob). Static proof: `run.sh` /
`run.log` prints the committed-before-checked ordering in-tree.

## Fix validation

`fix.diff` unwinds the publication (drm_ht_remove_item + free_unr +
on_map=false) when drm_vma_offset_add fails. Compile-validated on the
guest: drm.ko rebuilt with the patch, `-Werror`, RC=0 (build.log;
combined with sibling DF-4458/DF-4459 hunks). `git apply --check`
passes against the pristine tree. fix_status=not_testable (trigger not
injectable), compile-validated.

## Fix status (batch validation)
Applied with the 36 sibling fix.diffs of this batch in findings/poc/_batch41/all_fixes.patch; single in-guest `make -j6 nativekernel KERNCONF=X86_64_GENERIC` completed RC=0 with zero errors under -Werror (full log: findings/poc/_batch41/fix_build8.log). Behavior A/B intentionally skipped for this Info-tier item.