# DF-4678 — DragonFly devm_request_mem_region shim makes i915's stolen-region
conflict detection vacuous (+ static-rman/leak/off-by-one defects)

`sys/dev/drm/i915/i915_gem_stolen.c:83-104` (the `#ifdef __DragonFly__`
shim) versus the conflict check at :156-188.

**No runnable PoC on this guest** (no Intel GPU — the shim cannot execute);
this pack is the analysis record with line-accurate citations against the
guest's own /usr/src copy (md5-verified, env.txt). `verdict.json` records
status `untested` / impact `none` accordingly.

## What the shim does (and doesn't)

```c
static struct linux_resource * devm_request_mem_region(struct device *dev,
    resource_size_t start, resource_size_t n, const char *name)
{
	static struct rman stolen_rman;
	...
	if (rman_init(&stolen_rman, -1))      /* private, static rman */
		return NULL;
	if (rman_manage_region(&stolen_rman, ...))
		return NULL;
	res = kmalloc(sizeof(*res), M_DRM, GFP_KERNEL);
	return res;                           /* always non-NULL on success */
}
```

Upstream, `devm_request_mem_region()` fails (`NULL`) when the range conflicts
with another driver's reservation — the property `i915_adjust_stolen()`
depends on: *"if the region is already marked as busy, something is seriously
wrong"* → `-EBUSY` → stolen disabled (:182-187). On DragonFly:

1. **The check can never fire.** The shim's private static rman is consulted
   by nobody; `rman_manage_region()` performs no overlap check at all
   (subr_rman.c:123-150, "NB: this interface is not robust ... multiple
   copies"). The `-EBUSY` path is dead code; i915 proceeds with stolen on any
   BIOS.
2. **DF also never reserves stolen from phys_avail** — the
   `phys_avail_reserve(intel_graphics_stolen_base, ...)` call in
   sys/bus/pci/x86_64/pci_early_quirks.c:310-312 is commented out
   ("XXX: enable this once the KPI is available"). On firmware that leaves
   the stolen range inside e820-RAM, the kernel page allocator and the i915
   stolen allocator can own the same physical pages → silent GPU-DMA/kernel
   cross-corruption — the exact scenario the (now vacuous) check exists to
   catch.
3. Latent shim defects: `rm_end = start + n` manages one page too many (rman
   ranges are inclusive); a second call re-runs `rman_init()` on the live
   static rman → duplicate insert into the global `rman_head` + leaked
   `rm_slock` (subr_rman.c:87-116); the kmalloc'd `res` is never freed; and
   the retry at :175-177 passes `resource_size(dsm) - 2`, which underflows
   for a 1-page dsm.

## Fix

`fix.diff` repairs the shim internals (one-time init, inclusive end,
wrapped/empty-range refusal). True conflict detection needs kernel KPI the
shim doesn't have — the durable fix is the early-boot phys_avail reservation
(pci_early_quirks.c, cross-referenced). `git apply --check` clean; not
applicable to run on this guest (`fix_status: not_testable`).

Related but separate: DF-1712 (unzeroed stolen fbdev, pass 1) and DF-4679
(reserved-base u64 wrap, same file).