{
  "finding_id": "DF-4870",
  "status": "untested",
  "reproduced": 0,
  "impact": "none",
  "confidence": "certain",
  "verdict": "Code-evident resource leak, certain by source reading: r600_dma_ib_test() returns on both fence-wait error paths (r600_dma.c:371-377) without radeon_ib_free(), while the later -EINVAL path frees (r600_dma.c:391) \u2014 one 64KB IB-pool sa_bo chunk plus the ib.fence reference leak per failed DMA ib test. Runtime verification is hardware-gated: the bug requires an r6xx-class Radeon DMA engine hung at init/resume; the audit QEMU guest has only a Bochs emulated VGA (0x1111:1234), no /dev/dri, and radeon.ko is not loaded (env.txt). Impact ceiling: progressive IB-pool exhaustion on an already-degraded GPU (A:L); no kernel memory corruption, no privilege escalation path.",
  "exploit_chain": "",
  "evidence": "findings/poc/DF-4870/VERDICT.md (line-by-line trace r600_dma.c:351-392, radeon_ib.c:57-81, caller chain radeon_device.c:1486/1748/1932); env.txt (guest GPU inventory proving hardware gate); fix.diff (adds the two missing radeon_ib_free calls, mirroring r600_dma.c:391)",
  "kernel_refs": [
    "sys/dev/drm/radeon/r600_dma.c:369",
    "sys/dev/drm/radeon/r600_dma.c:374",
    "sys/dev/drm/radeon/r600_dma.c:391",
    "sys/dev/drm/radeon/radeon_ib.c:73",
    "sys/dev/drm/radeon/radeon_device.c:1486"
  ],
  "poc_changes": "n/a \u2014 no PoC seed existed; no userland trigger is constructible (init-time kernel path on real hardware)",
  "attempts": 1,
  "guest_uname": "DragonFly dfbsd 6.5-DEVELOPMENT DragonFly 6.5-DEVELOPMENT #0: Thu Jul  2 06:02:54 UTC 2026  root:dfbsd:/usr/obj/usr/src/sys/X86_64_GENERIC  x86_64",
  "runtime_sec": 12,
  "guest_dirty": 0,
  "build_cmd": "",
  "run_cmd": "dfbsd-qemu/vm.sh run_root pciconf -l; kldstat; ls /dev/dri (env probe \u2014 see run.log/env.txt)",
  "code_hash": "",
  "notes": "Hardware-gated Low finding: per contract Phase V is skippable for Low severity; recorded as untested (persist_poc enum) rather than not_testable. Same leak shape exists upstream in Linux r600_dma.c \u2014 candidate for upstream contribution alongside the fix. Not a duplicate of DF-1942 (copy size overflow) or DF-1943 (ring reservation): different function, different mechanism.",
  "recommended_fix": "Add radeon_ib_free(rdev, &ib) before both fence-wait error returns in r600_dma_ib_test()",
  "fix_status": "not_testable",
  "fix_baseline_reproduced": 0,
  "fix_patched_reproduced": 0,
  "fix_verdict": "fix.diff authored from line-accurate source reading (mirrors the existing free at r600_dma.c:391); kernel fix-build validation impossible on this guest \u2014 no Radeon hardware to drive the ib test fence path",
  "fix_evidence": "findings/poc/DF-4870/fix.diff"
}