# DF-4496 — dce100_create_resource_pool leaks the pool shell on construct() failure

**File:** `sys/dev/drm/amd/display/dc/dce100/dce100_resource.c:1056-1071`
**Family:** DF-4318 (dce80 ×3) / DF-4353 (dce110) / DF-4376 (dce112) twin.

## What

```c
struct resource_pool *dce100_create_resource_pool(...)
{
	struct dce110_resource_pool *pool =
		kzalloc(sizeof(struct dce110_resource_pool), GFP_KERNEL);  /* :1060 */

	if (!pool)
		return NULL;
	if (construct(num_virtual_links, dc, pool))
		return &pool->base;

	BREAK_TO_DEBUGGER();
	return NULL;		/* :1070 — pool is never freed */
}
```

`construct()`'s error arm (`res_create_fail`, :1050-1053) runs
`destruct(pool)` (:678-745), which frees all successfully-created
sub-objects — but never the `struct dce110_resource_pool` shell itself
(`dce100_destroy_resource_pool` :838-845, the only kfree site, is reachable
only for a pool that was returned successfully). The caller
(`dc_create_resource_pool`, `core/dc_resource.c:125-128`) receives NULL and
cannot free an allocation it never saw.

`struct dce110_resource_pool { struct resource_pool base; }`
(`dce110_resource.h:37-39`) — the whole allocation is the shell (~2 KB of
pointer arrays). Triggered once per failed `amdgpu` bind on a DCE10/Tonga
ASIC (e.g. when any sub-object allocation fails at probe). One-shot leak,
no unprivileged trigger — impact is resource loss on an already-failing
probe, severity Low.

## Reproduce (guest-side control-flow model — no AMD GPU required)

```
cc -O2 -Wall -o df4496 df4496.c   # build.sh
./df4496                          # run.sh
```

Expected decisive output (`run.log`, re-confirmed in `run.2.log`):

```
LEAK CONFIRMED (model): struct dce110_resource_pool is orphaned on
construct() failure — dce100_resource.c:1066-1070 lacks kfree(pool).
```

with `live_allocs=1` (the orphaned shell) after the failure path while all
children were reclaimed by `destruct()`, and `live_allocs=0` after destroy
on the success path (proving the model's ownership accounting is faithful).

## Why not a kernel PoC on the audit guest

`env.txt`: the guest has **0 AMD/ATI PCI devices**; the amdgpu/dce100 path
never executes. Same situation as the accepted family twins
(DF-4318/DF-4353/DF-4376). The defect is source-certain (control flow is
six lines); runtime impact is hardware-gated.

## Fix

`fix.diff` (git-apply clean against this tree): add `kfree(pool);` before
the `BREAK_TO_DEBUGGER(); return NULL;` failure return — identical to the
accepted DF-4318 fix.