# fix validation run: guest /usr/src patched with fix.diff (dma_buf_get keeps the file
# reference, matching the Linux fget contract), drm.ko + df4515mod rebuilt, same PoC step 5.
# BASELINE (unpatched, same guest image): f_count 2 -> 1 -> 0, dma_buf freed while fd
#   installed, "panic: fdrop: invalid f_count -1" at process exit  (see run.log/panic.txt)
login: df4515mod: loaded (DF-4515/DF-4516 primitive driver)
df4515mod: [5] H2F: dmabuf=0xfffff8008d721d90 fp=0xfffff80116db9080 fd=3 f_count=2
df4515mod: [5] F2H lookup-hit cycle #1 done; f_count now 2
df4515mod: [5] F2H lookup-hit cycle #2 done; f_count now 2
df4515mod: [5] F2H lookup-hit cycle #3 done; f_count now 2
df4515mod: [5] touching freed file via installed fd:
df4515mod: [5] survived UAF touch (dma_buf_get -> 0)
dma_buf_attach: not implemented
df4515mod: [6] dma_buf_attach -> 0xffffffffffffffb2 IS_ERR=1