{
  "finding_id": "DF-4579",
  "status": "not_reproduced",
  "reproduced": 0,
  "impact": "dos",
  "confidence": "certain",
  "verdict": "Source-certain kernel memory leak, unreachable on this guest for lack of ATI hardware (only virtio-gpu present; /dev/dri absent; radeon.ko never attaches \u2014 QEMU cannot emulate radeon VGA; same HW-absent situation as DF-4564). The live chain: radeon_driver_attach (radeon_drv.c:834, the only live drm_get_pci_dev caller besides the fully-#if 0 drm_legacy_pci_init) -> radeon_pci_probe (radeon_drv.c:433) -> drm_get_pci_dev (drm_pci.c:318 drm_dev_alloc, :338 drm_dev_register) -> on register/load failure (Fatal error during GPU init, radeon_kms.c:137) the err_agp block at drm_pci.c:343-357 is entirely #if 0d out \u2014 upstreams err_free: drm_dev_unref(dev) was deleted in the DragonFly port \u2014 so dev leaks. drm_dev_registers err_minors (drm_drv.c:915-918) only unregisters minors; radeon_driver_load_kms self-cleans via radeon_driver_unload_kms (radeon_kms.c:170); the callers drm_fini_pdev (radeon_drv.c:836) is correct. Exactly one struct drm_device per failed attach; re-attemptable per kldload/boot with failing hardware. Root/hardware-triggered only => Low.",
  "exploit_chain": "",
  "evidence": "VERDICT.md (full path:line trace and leak-boundary analysis); env.txt + run.log (guest has no 0x1002 device); fix.diff (restores upstream drm_dev_unref on the error path; drm_dev_unref exists at drm_drv.c:789)",
  "kernel_refs": [
    "sys/dev/drm/radeon/radeon_drv.c:433",
    "sys/dev/drm/radeon/radeon_drv.c:812-839",
    "sys/dev/drm/drm_pci.c:309-357",
    "sys/dev/drm/drm_pci.c:338-357",
    "sys/dev/drm/drm_drv.c:877-924",
    "sys/dev/drm/radeon/radeon_kms.c:131-173"
  ],
  "poc_changes": "not applicable \u2014 no trigger source; the PoC would be kldload radeon on failing ATI hardware, impossible on this guest",
  "attempts": 1,
  "guest_uname": "DragonFly dfbsd 6.5-DEVELOPMENT DragonFly 6.5-DEVELOPMENT #0: Thu Jul  2 06:02:54 UTC 2026 root@dfbsd:/usr/obj/usr/src/sys/X86_64_GENERIC x86_64",
  "runtime_sec": 30,
  "guest_dirty": 0,
  "build_cmd": "",
  "run_cmd": "kldload radeon (requires ATI hardware; guest has none \u2014 see env.txt)",
  "code_hash": "",
  "notes": "HW-absent verdict follows the DF-4564 precedent (not_reproduced on this guest, source-certain). Cross-ref observations for core-file owners (not filed here, files not in this batch): drm_init_pdev (drm_dragonfly.c:136-161) has unchecked kzallocs for pdev/bus/bus->self (OOM NULL-deref at attach); drm_dev_register publishes /dev/dri nodes and sets registered=true (drm_drv.c:884-894) BEFORE driver->load runs \u2014 an upstream-inherited open/ioctl window during load that radeon handlers only partially guard (accel_working, exclusive_lock); radeon_ioctls table itself is upstream-identical (radeon_kms.c:876-922) and num_ioctls==ARRAY_SIZE so drm_ioctl.c:823 bounds are tight.",
  "recommended_fix": "restore the drm_get_pci_dev error unwind: move drm_dev_unref(dev) out of the #if 0 block so failed drm_dev_register frees the drm_device (fix.diff)",
  "fix_status": "not_testable",
  "fix_baseline_reproduced": 0,
  "fix_patched_reproduced": 0,
  "fix_verdict": "fix.diff authored against read-only sys/ (restores upstream err_free: drm_dev_unref); cannot be runtime-validated on this guest (no ATI hardware \u2014 neither baseline nor patched behavior observable)",
  "fix_evidence": "fix.diff"
}