{"finding_id":"DF-4899","status":"untested","attempts":0,"reproduced":0,"impact":"leak","confidence":"certain","verdict":"Hardware-gated: vpoio/imm_attach kmalloc the microseq buffer and claim the ppbus BEFORE vpo_attach proceeds to CAM registration, but all three CAM failure exits skip the unwind (the in-source XXX admits it) and the driver registers NO detach method (and no vpoio_detach/imm_detach exists anywhere) - so on failure the M_DEVBUF buffer leaks and the ppbus stays permanently claimed (lpt/ppi unusable until reboot); even deliberate release is impossible. Add low-level detach + unwind fix.","exploit_chain":"ZIP present + CAM alloc failure at attach -> microseq leak + ppbus permanently claimed","evidence":"findings/poc/DF-4899/ (this verdict)","kernel_refs":["sys/dev/disk/vpo/vpo.c:139-167","sys/dev/disk/vpo/vpo.c:450-456","sys/dev/disk/vpo/vpoio.c:600-616"],"guest_uname":"","code_hash":""}