{
  "finding_id": "DF-4909",
  "status": "untested",
  "attempts": 0,
  "reproduced": 0,
  "impact": "corruption",
  "confidence": "certain",
  "verdict": "Latent (no in-tree DRIVER_LEGACY driver; CAP_SYS_ADMIN + feature-gated creation): the DF port broke the _DRM_CONSISTENT alloc/free contract - drm_pci_alloc returns a descriptor carrying tag+map, addmap kfrees it immediately (keeping only vaddr/busaddr in the map, so every CONSISTENT map leaks its DMA memory+map+tag forever), and rmmap FORGES the handle on the stack setting only vaddr/busaddr/size, so the DF __drm_legacy_pci_free runs bus_dmamap_unload/bus_dmamem_free/bus_dma_tag_destroy on uninitialized stack pointers (wild bus_dma teardown - panic at minimum, groomed kfree at worst). Upstream Linuxs free primitive consumes exactly the three forged fields - this break is DF-specific. Detonation paths once a legacy driver exists: RM_MAP is DRM_AUTH-only (unpriv after root creates one map) or master-drop auto-cleanup. Keep-the-descriptor fix.",
  "exploit_chain": "root ADDMAP(_DRM_CONSISTENT) -> descriptor freed, tag/map discarded -> any DRM_AUTH client RM_MAP (or master-drop) -> bus_dma teardown on stack garbage -> panic/corruption",
  "evidence": "findings/poc/DF-4909/ (this verdict; sink provably reads fields no caller writes)",
  "kernel_refs": [
    "sys/dev/drm/drm_pci.c:152-160",
    "sys/dev/drm/drm_bufs.c:324-331",
    "sys/dev/drm/drm_bufs.c:502",
    "sys/dev/drm/drm_bufs.c:541-547"
  ],
  "guest_uname": "",
  "code_hash": ""
}