{
  "finding_id": "DF-4819",
  "status": "untested",
  "reproduced": 0,
  "impact": "none",
  "confidence": "certain",
  "verdict": "Structural defect CONFIRMED at source and binary level: the DFly linux-compat shim has no register_shrinker (sys/dev/drm/include/linux/shrinker.h is struct-only), the i915 registration block and the count/scan bodies are #if 0d out (i915_gem_shrinker.c:313-395, 521-532), and vm_lowmem is never EVENTHANDLER_INVOKEd anywhere in sys/ \u2014 so the i915 GEM shrinker can never run from memory reclaim. Verified statically (run.log, 6x PASS) and against the guests compiled i915.ko/drm.ko symbol tables (run.guest.log: no register_shrinker symbol; count/scan are local dead stubs). The DoS impact (GPU shmem pages unreclaimable under pressure -> OOM kills) requires real i915 hardware, which the QEMU audit guest lacks (std VGA 1234:1111, i915 never attaches) \u2014 recorded untested/impact-none consistent with the DF-4507 family precedent; potential impact is local DoS (Medium).",
  "exploit_chain": "",
  "evidence": "run.log: six PASS lines proving no registration path exists in the workspace sys/ tree; run.guest.log: nm of /boot/kernel/i915.ko shows i915_gem_shrinker_count/scan as local (t) stubs and no register_shrinker symbol in i915.ko or drm.ko, plus guest context (uname, QEMU std VGA, no drm modules loaded); VERDICT.md: full per-line narrative incl. pass-2 sweep of the live i915_gem_shrink walk (lockowned==curthread at kern_lock.c:1365, struct_mutex lifetime invariant, empty-list-safe splice, no self-deadlock, u64 arithmetic sound).",
  "kernel_refs": [
    "sys/dev/drm/i915/i915_gem_shrinker.c:313",
    "sys/dev/drm/i915/i915_gem_shrinker.c:353",
    "sys/dev/drm/i915/i915_gem_shrinker.c:516",
    "sys/dev/drm/include/linux/shrinker.h:35",
    "sys/dev/drm/ttm/ttm_page_alloc.c:447"
  ],
  "poc_changes": "No seed PoC existed for this pass-2 finding; authored check_shrinker_wiring.sh (dual-mode: static tree proof + compiled-module nm proof). Base64 transfer to guest failed (DFly lacks base64(1)); ran the module-mode checks inline via vm.sh run_root instead \u2014 same commands, captured verbatim in run.guest.log.",
  "attempts": 3,
  "guest_uname": "DragonFly dfbsd 6.5-DEVELOPMENT DragonFly v6.5.0.1712.g89e6a-DEVELOPMENT #1: Mon Jun 29 14:18:01 UTC 2026  root@ephemeral-5c2002c44b6c:/usr/obj/usr/src/sys/X86_64_GENERIC  x86_64",
  "runtime_sec": 75,
  "guest_dirty": 0,
  "build_cmd": "./build.sh (no-op: structural verification, nothing compiled)",
  "run_cmd": "./run.sh ; sh check_shrinker_wiring.sh --module /boot/kernel/i915.ko",
  "code_hash": "5094b677f10e4611596eff1fcd438975a7e750848f4755626342d734613d4f81",
  "notes": "DF-4507 family (TTM pools) \u2014 this finding is the i915-GEM-objects instance of the same missing-reclamation-infrastructure defect. Live callers of i915_gem_shrink are explicit-only (i915_gem.c:2935 get_pages retry, i915_gem_gtt.c:2449 dma-map retry, i915_gem.c:6324/6353 freeze paths) \u2014 the live walk itself audited clean. Fix is feature-sized (needs a real DFly VM-pressure hook + register_shrinker shim); not validatable on the available guest, so no fix validation performed.",
  "recommended_fix": "Implement register_shrinker in sys/dev/drm/include/linux/shrinker.h wired to a VM-pressure event that DragonFly actually invokes (e.g. make vm_pageout EVENTHANDLER_INVOKE(vm_lowmem,...)), then un-#if0 the i915 registration block and the count/scan bodies (converting spin_lock to lockmgr in the restored count callback).",
  "fix_status": "not_testable",
  "fix_baseline_reproduced": 0,
  "fix_patched_reproduced": 0,
  "fix_verdict": "Fix validation not possible: the fix requires new kernel VM infrastructure plus real i915 hardware to validate; the QEMU audit guest has no Intel GPU and the DoS baseline cannot be reproduced there in the first place.",
  "fix_evidence": "n/a"
}