{
  "finding_id": "DF-4898",
  "status": "untested",
  "attempts": 0,
  "reproduced": 0,
  "impact": "leak",
  "confidence": "certain",
  "verdict": "Hardware-gated (no ZIP on the guest parallel port): the async XPT_SCAN_BUS rescan at attach never releases its resources - the callback frees only the CCB (never xpt_free_path), leaking the kmallocd cam_path plus its pinned topology refs on EVERY successful attach; the xpt_create_path failure branch leaks the whole ~1KB CCB incl. its callout. The kernels own pattern (and aac/ciss/mrsas) frees both. Free-the-path + free-the-ccb-on-fail fix.",
  "exploit_chain": "ZIP/imm device attaches -> rescan runs -> cam_path + topology refs leak per attach",
  "evidence": "findings/poc/DF-4898/ (this verdict)",
  "kernel_refs": [
    "sys/dev/disk/vpo/vpo.c:176-180",
    "sys/dev/disk/vpo/vpo.c:188-193",
    "sys/cam/cam_xpt.c:4938-4944"
  ],
  "guest_uname": "",
  "code_hash": ""
}