{
  "finding_id": "DF-4460",
  "status": "inconclusive",
  "reproduced": 0,
  "impact": "none",
  "confidence": "certain",
  "verdict": "Code defect certain (Info-grade impact): drm_gem_create_mmap_offset_size (drm_gem.c:566-588) allocates the unr idx and inserts the legacy offset-hash item, then sets obj->on_map = true (583) BEFORE learning whether drm_vma_offset_add() (585, drm_vma_manager.c:200-215) succeeded. On failure the function returns the error but leaves the publication committed: the 22-bit idx and hash slot leak until object release (drm_gem_free_mmap_offset 529-546 self-heals via the same on_map flag), obj state is inconsistent, and any retry hits the early-return at 573-574 and reports success while obj->vma_node still has no offset (drm_vma_node_offset_addr would yield 0 for Linux-path callers). On DragonFly the user-visible offset scheme uses map_list.key (i915_gem.c:2647-2649), so the practical impact is the leaked publication + inconsistent state \u2014 no demonstrated memory-safety impact. Trigger (drm_mm insert failure / range exhaustion) is not injectable on the QEMU guest; defect proven statically (run.log).",
  "exploit_chain": "",
  "evidence": "run.log (ordering: 583 before 585-586, retry early-return 573-574, release-only cleanup at 543); build.log (drm.ko rebuilt with fix, -Werror, DRM_BUILD_RC=0); fix.diff (git apply --check OK)",
  "kernel_refs": [
    "sys/dev/drm/drm_gem.c:576",
    "sys/dev/drm/drm_gem.c:583",
    "sys/dev/drm/drm_gem.c:585",
    "sys/dev/drm/drm_vma_manager.c:200"
  ],
  "poc_changes": "no seed; static-verification script authored for the pack",
  "attempts": 1,
  "guest_uname": "DragonFly dfbsd 6.5-DEVELOPMENT DragonFly 6.5-DEVELOPMENT #0: Thu Jul  2 06:02:54 UTC 2026     root@dfbsd:/usr/obj/usr/src/sys/X86_64_GENERIC  x86_64",
  "runtime_sec": 60,
  "guest_dirty": 0,
  "build_cmd": "cd /usr/src/sys/dev/drm/drm && make obj && make   (patched, guest cc 8.3, -Werror, RC=0)",
  "run_cmd": "sh run.sh sys/dev/drm/drm_gem.c",
  "code_hash": "",
  "notes": "drm_vma_offset_remove on a never-added node is a documented safe no-op (drm_vma_manager.c:228-239), so the pre-fix state is not a crash risk. Guest /usr/src restored pristine; guest up.",
  "recommended_fix": "Unwind the hash/unr publication (drm_ht_remove_item + free_unr + on_map=false) when drm_vma_offset_add() fails",
  "fix_status": "not_testable",
  "fix_baseline_reproduced": 0,
  "fix_patched_reproduced": 0,
  "fix_verdict": "fix.diff (git apply --check OK) unwinds the publication on drm_vma_offset_add failure so retries start clean. Compile-validated on the guest: drm.ko rebuilt with the fix, -Werror, RC=0 (build.log). Behavioral runs impossible: the trigger (drm_mm insert failure) is not injectable on this guest (fix_status not_testable, compile-validated).",
  "fix_evidence": "fix.diff; build.log (patched drm.ko full -Werror compile+link, DRM_BUILD_RC=0); VERDICT.md Fix validation"
}