{
  "finding_id": "DF-4516",
  "status": "reproduced",
  "reproduced": 1,
  "impact": "panic",
  "confidence": "certain",
  "verdict": "drm_prime.cs import helper attaches via dma_buf_attach() (drm_prime.c:733) which on this port is a stub returning NULL instead of ERR_PTR (dma-buf.h:96-101); IS_ERR(NULL) does not catch it, dma_buf_map_attachment(NULL) fails with -EINVAL, and the fail_detach unwind (drm_prime.c:758) calls dma_buf_detach() which is hardcoded panic(dma_buf_attach is not implemented). Any unprivileged video-group user importing a foreign dma-buf on radeon/amdgpu (generic import helper) panics the kernel. Proven on the guest with the shipped drm.ko: the exact drm_prime.c:733-758 sequence panics deterministically; fix.diff (ERR_PTR(-ENOSYS) + no-panic detach) makes the same sequence fail cleanly with IS_ERR catching the error.",
  "exploit_chain": "Requires two DRM devices (foreign dma-buf): export a GEM object on GPU A via PRIME_HANDLE_TO_FD, pass the fd to a process with GPU Bs card open (radeon or amdgpu), issue DRM_IOCTL_PRIME_FD_TO_HANDLE -> dma_buf_attach NULL -> map -EINVAL -> fail_detach -> panic. Pure DoS (panic), no escalation path.",
  "evidence": "run.log (dma_buf_attach -> 0 IS_ERR=0, map_attachment -> -22, goto fail_detach), panic.txt (panic: dma_buf_attach is not implemented with syscall trace), fix_run.log (0xffffffffffffffb2 IS_ERR=1, no panic)",
  "kernel_refs": [
    "sys/dev/drm/drm_prime.c:733",
    "sys/dev/drm/drm_prime.c:734",
    "sys/dev/drm/drm_prime.c:739",
    "sys/dev/drm/drm_prime.c:758",
    "sys/dev/drm/include/linux/dma-buf.h:96",
    "sys/dev/drm/include/linux/dma-buf.h:129",
    "sys/dev/drm/linux_dma-buf.c:196",
    "sys/dev/drm/radeon/radeon_drv.c:699",
    "sys/dev/drm/amd/amdgpu/amdgpu_prime.c:445"
  ],
  "poc_changes": "Shared trigger module with DF-4515; step 6 replays drm_prime.c:733->739->758. The real entry needs two GPUs (guest has none) - documented in VERDICT.md.",
  "attempts": 1,
  "guest_uname": "DragonFly dfbsd 6.5-DEVELOPMENT DragonFly 6.5-DEVELOPMENT #0: Thu Jul  2 06:02:54 UTC 2026     root@dfbsd:/usr/obj/usr/src/sys/X86_64_GENERIC  x86_64",
  "runtime_sec": 420,
  "guest_dirty": 0,
  "build_cmd": "cd /usr/src/sys/dev/drm/drm && make obj && make -j4; cd /root/df4515 && make",
  "run_cmd": "kldload /usr/obj/usr/src/sys/dev/drm/drm/drm.ko; kldload /root/df4515/df4515mod.ko; sysctl hw.df4515mod.fire=6",
  "code_hash": "68d0f0556809bb4d163b0f09a510f82bd33e0571d9c299f2e37ba4a088ed5e4a",
  "notes": "Same guest session as DF-4515 (separate boot). i915s private import path (i915_gem_dmabuf.c:305-321) avoids the panic but creates a zombie object with import_attach=NULL and no dma_buf reference - noted as follow-up for the i915 files own audit. Guest reset clean after runs.",
  "recommended_fix": "dma_buf_attach() stub must return ERR_PTR(-ENOSYS) instead of NULL, and dma_buf_detach() must not panic(); drm_prime.c:734s existing IS_ERR check then yields a clean ioctl failure.",
  "fix_status": "fixed",
  "fix_baseline_reproduced": 1,
  "fix_patched_reproduced": 0,
  "fix_verdict": "fix.diff applied to guest /usr/src (dma-buf.h), drm.ko + module rebuilt, identical PoC step 6 re-run: dma_buf_attach returned ERR_PTR(-ENOSYS) with IS_ERR=1 (0xffffffffffffffb2), the sequence broke out cleanly before map/detach, no panic, guest stayed up. Baseline panic gone.",
  "fix_evidence": "findings/poc/DF-4516/fix_run.log vs run.log + panic.txt"
}