{
  "finding_id": "DF-4896",
  "status": "untested",
  "reproduced": 0,
  "impact": "kernel memory leak: full struct request + rqg chain + XFR_MALLOCED buffers + XFR_BUFLOCKED buf locks per errored volume I/O; unbounded with VF_RETRYERRORS (daemon retry loop leaks at I/O speed); VOL[].active counter also never decremented on the error path",
  "confidence": "certain",
  "verdict": "Inspection-certain leak, not runnable on this guest: complete_rqe() hands the failed volume request to the daemon (vinuminterrupt.c:223-225) whose only consumer recover_io() (vinumdaemon.c:198-209) re-strategizes the bio via dev_dstrategy without ever calling freerq() on the old request \u2014 compare the success path (vinuminterrupt.c:231-232) and vinumstarts failure paths (vinumrequest.c:273/:300) which all freerq. Triggering requires a component bio error at completion; this guests md-backed vinum drives cannot be made to fail I/O (re-verified 2026-09-24: gpt destroy/gpt remove under open vinum I/O leave the stale slice cdev serving requests with no error; no mdconfig fault-injection on the image) \u2014 same facility gap DF-4481 recorded. Proposed fix (freerq + vol->active-- in recover_io before re-strategy) in README.md; not buildable/validatable without error injection.",
  "exploit_chain": "",
  "evidence": "README.md (line-cited dataflow: vinuminterrupt.c:219-226 handoff, vinumdaemon.c:198-209 abandonment, success-path contrast); amplification via VF_RETRYERRORS loop",
  "kernel_refs": [
    "sys/dev/raid/vinum/vinuminterrupt.c:223",
    "sys/dev/raid/vinum/vinuminterrupt.c:229",
    "sys/dev/raid/vinum/vinumdaemon.c:198",
    "sys/dev/raid/vinum/vinumrequest.c:231",
    "sys/dev/raid/vinum/vinumrequest.c:273"
  ],
  "poc_changes": "no seed; trigger sketch (trigger.sh waiting on a failure-injection facility) documented in README",
  "attempts": 0,
  "guest_uname": "DragonFly dfbsd 6.5-DEVELOPMENT #0 Thu Jul 2 06:02:54 UTC 2026 x86_64",
  "runtime_sec": 0,
  "guest_dirty": 0,
  "build_cmd": "n/a (no runnable PoC on this guest)",
  "run_cmd": "n/a (requires component I/O-error injection; md devices on this image cannot fail \u2014 verified)",
  "code_hash": null,
  "notes": "Error-injection experiments performed and exhausted: gpt destroy -f (option absent on guest gpt(8)), gpt remove under open I/O (stale cdev keeps serving, no error), mdconfig absent. Severity Low (root-configured failing hardware or retryerrors flag needed).",
  "recommended_fix": "recover_io(): capture bio/dev, drop VOL[].active for volume requests, freerq(rq), then dev_dstrategy(dev, bio) (diff in README.md).",
  "fix_status": "not_testable",
  "fix_baseline_reproduced": 0,
  "fix_patched_reproduced": 0,
  "fix_verdict": "not_testable: no failure-injection facility on the guest to stage the leak",
  "fix_evidence": "README.md proposed diff"
}