{
  "finding_id": "DF-4698",
  "status": "untested",
  "reproduced": 0,
  "impact": "none",
  "confidence": "certain",
  "verdict": "Analysis-certain error-path defect, not drivable on the available emulator: nvme_admin_state_make_queues() frees failed completion queues including the partially-created one (subq loop uses no matching ++i), so after a create failure + 1/1 retry the still-allocated subqueues[1] is re-alloced: lockinit on a live lock and the previous ksubq/kprps/reqary DMA allocations are overwritten without free -> permanent leak per occurrence. Trigger requires a controller that fails a queue-create then succeeds on retry; QEMU 7.2 never fails queue creation, so PoC left untested by design.",
  "exploit_chain": "",
  "evidence": "findings/poc/DF-4698/README.md (line-accurate trace); nvme_admin.c:453-515, nvme.c:126-145, nvme.c:197-228",
  "kernel_refs": [
    "sys/dev/disk/nvme/nvme_admin.c:471",
    "sys/dev/disk/nvme/nvme_admin.c:482",
    "sys/dev/disk/nvme/nvme_admin.c:494",
    "sys/dev/disk/nvme/nvme_admin.c:514",
    "sys/dev/disk/nvme/nvme.c:135",
    "sys/dev/disk/nvme/nvme.c:145",
    "sys/dev/disk/nvme/nvme.c:197"
  ],
  "poc_changes": "no seed; analysis-only pack",
  "attempts": 0,
  "guest_uname": "DragonFly dfbsd 6.5-DEVELOPMENT #0: Thu Jul  2 06:02:54 UTC 2026 x86_64",
  "runtime_sec": 0,
  "guest_dirty": 0,
  "build_cmd": "",
  "run_cmd": "",
  "code_hash": "",
  "fix_status": "not_testable",
  "fix_baseline_reproduced": 0,
  "fix_patched_reproduced": 0,
  "fix_verdict": "trigger cannot be generated by the available device model (QEMU 7.2 always succeeds queue creation)",
  "fix_evidence": "",
  "notes": "Low severity: device-gated resource leak + lock re-init, no demonstrated memory-safety violation.",
  "recommended_fix": "Free any still-allocated queues before re-allocating in the tryagain path and make the subq unwind loop include the failed queue index."
}