DF-4927 radeon_sa fence-borrow UAF - BASELINE (DragonFly sys/dev/drm/radeon/radeon_sa.c as-is) mode
scenario: X[0,1024)GFX/F-pending  A[1024,2048)DMA/sig  B[2048,3072)DMA/sig  Z[3072,4096)DMA/pending; request 3500B
sa_bo_new(3500, 256):
    [fence F2 refcount 0 -> kfree]
    [fence F3 refcount 0 -> kfree]
    [fence F1 refcount 0 -> kfree]
  *** UAF-REF    fence F1 (refcount=0) at radeon_sa_bo_new:352 fence_ref
  *** UAF-WAIT   fence F1 (refcount=1) at radeon_sa_bo_new:356 fence_wait_any
  *** DOUBLE-FREE fence F1 (refcount=1) at radeon_sa_bo_new:358 fence_unref
radeon_sa_bo_new -> -513 (would block/fail)

===== RESULT =====
UAF fence_ref     (sa.c:352-353): 1
UAF fence_wait    (sa.c:356)    : 1
double fence_free (sa.c:357-358): 1
VERDICT: UAF/double-free REPRODUCED on the ported allocator logic
baseline exit=42