{"finding_id":"DF-4938","status":"untested","attempts":0,"reproduced":0,"impact":"leak","confidence":"certain","verdict":"Resource-exhaustion hygiene (Info, hw-gated): the gfx sw_init allocates persistent KIQ/MQD kernel BOs (KIQ EOP, KIQ MQD in VRAM, up to 8 compute MQDs in GTT) plus mqd_backup kmallocs with NO internal unwind, and the only teardown (sw_fini) is gated behind a fully-successful sw_init by the driver core - every bare return r in gfx_v8/v9 sw_init after kiq_init succeeds permanently pins ~9 BOs + 9 kmallocs until reboot, accumulating across probe retries. No unpriv trigger, no corruption. Unwind-in-callers fix (representative gfx_v9 diff).","exploit_chain":"mid-probe failure (GTT/VRAM pressure) after kiq_init -> stranded BOs/kmallocs -> accumulate per retry","evidence":"findings/poc/DF-4938/ (this verdict; static call-graph proof)","kernel_refs":["sys/dev/drm/amd/amdgpu/amdgpu_gfx.c:282-357","sys/dev/drm/amd/amdgpu/amdgpu_device.c:1637-1643","sys/dev/drm/amd/amdgpu/amdgpu_device.c:1898-1900","sys/dev/drm/amd/amdgpu/gfx_v9_0.c:1798-1822"],"guest_uname":"","code_hash":""}