{"finding_id":"DF-4920","status":"untested","attempts":0,"reproduced":0,"impact":"none","confidence":"certain","verdict":"Protocol-accounting degradation (no panic/corruption/hang as shipped; Low): modeset_lock normalizes -EALREADY to 0 BEFORE the unconditional tracking block, and the DFly ww shim never returns -EALREADY (LK_CANRECURSE lockmgr silently recurses for same-ctx relock and returns 0) - so every recursive acquire double-tracks: a second info on both lists, ctx->acquired +1, ww->ctx/stamp overwritten. The first unlock clears ww->ctx while the hold-count is still >0; the second skips the decrement - the ctx permanently believes it holds a lock while holding none, taking the contended path with zero locks (spurious EDEADLK, violating the ww invariant; retry churn). REACHED ROUTINELY: drm_atomic_get_connector_state + add_affected_connectors both lock connection_mutex with the same ctx in one atomic pass. LATENT TRAP: if the shim is ever fixed to Linux -EALREADY semantics, this code double-unlocks -> kern_lock panic. Skip-tracking-if-already-tracked fix.","exploit_chain":"MODE_ATOMIC forcing a modeset -> same-ctx recursive connection_mutex lock -> acquired skew -> spurious EDEADLK/backoff churn mid-ioctl","evidence":"findings/poc/DF-4920/ (this verdict)","kernel_refs":["sys/dev/drm/drm_modeset_lock.c:269-289","sys/dev/drm/linux_wwmutex.c:109-121","sys/dev/drm/linux_wwmutex.c:188-203","sys/dev/drm/drm_atomic.c:778","sys/dev/drm/drm_atomic.c:880"],"guest_uname":"","code_hash":""}