{
  "finding_id": "DF-4579",
  "title": "radeon: every failed PCI attach leaks one drm_device — DragonFly's drm_get_pci_dev has its error unwind #if 0'd out (upstream err_free: drm_dev_unref deleted); radeon_drv.c:433 is the only live caller",
  "verdict": "not_reproduced",
  "impact": "dos",
  "reproduce": {
    "build": "(no build required — defect is in shipped kernel/KLD code)",
    "run": "on ATI hardware: kldload radeon (or boot) with a load failure ('Fatal error during GPU init', radeon_kms.c:137); repeat kldload/unload — each failed attach leaks one struct drm_device. Guest here has no ATI VGA so the path cannot run.",
    "expected": "baseline: unbounded drm_device leak across repeated failed attaches; with fix.diff applied: no leak"
  },
  "kernel_refs": [
    "sys/dev/drm/radeon/radeon_drv.c:382-434",
    "sys/dev/drm/radeon/radeon_drv.c:812-839",
    "sys/dev/drm/radeon/radeon_drv.c:879-880",
    "sys/dev/drm/drm_pci.c:309-357",
    "sys/dev/drm/drm_pci.c:318",
    "sys/dev/drm/drm_pci.c:338-357",
    "sys/dev/drm/drm_drv.c:789",
    "sys/dev/drm/drm_drv.c:877-924",
    "sys/dev/drm/radeon/radeon_kms.c:95-173"
  ],
  "artifacts": [
    "README.md",
    "VERDICT.md",
    "env.txt",
    "run.log",
    "fix.diff",
    "manifest.json",
    "verdict.json"
  ]
}