{"finding_id":"DF-4771","status":"untested","attempts":0,"reproduced":0,"impact":"leak","confidence":"certain","verdict":"Source-certain error-path leak, hardware-gated: intel_dp_add_mst_connector err: label runs drm_connector_cleanup but never kfrees the intel_connector allocated at :451 (the :462-464 path correctly frees). Reachable on drm_connector_attach_encoder failure or drm_connector_set_path_property/blob ENOMEM during hub plug-in storms - one kzalloc-sized leak per failed add. No i915+MST on guest. One-line kfree fix.","exploit_chain":"MST hub plug/unplug loop under ENOMEM pressure on path-blob alloc -> connector cleanup without kfree -> permanent kernel heap leak per cycle","evidence":"findings/poc/DF-4771/ (this verdict)","kernel_refs":["sys/dev/drm/i915/intel_dp_mst.c:451","sys/dev/drm/i915/intel_dp_mst.c:473-489"],"guest_uname":"","code_hash":""}