{
  "finding_id": "DF-4972",
  "status": "untested",
  "attempts": 0,
  "reproduced": 0,
  "impact": "corruption",
  "confidence": "certain",
  "verdict": "Root-gated 1-bit UAF write (Low; no DRM device on guest): the magic id lives in the ALLOCATION-TIME masters idr, but drm_master_release removes it from the CLOSE-TIME master - a SETMASTER swap (DRM_ROOT_ONLY in this tree, unlike upstream) leaves the (id -> drm_file*) entry dangling in the old masters idr after the drm_file is kfreed, and any is_master holder of the old master calling AUTH_MAGIC writes authenticated=1 (a single bit at a fixed offset) through the freed pointer into groomable memory. DF-2017s disabled exclusivity keeps the old master alive and lookup-reachable. Remove-from-old-master-before-swap fix.",
  "exploit_chain": "fd2 GETMAGIC (id N in M1) -> fd2 SETMASTER (root: master->M2, magic not migrated) -> fd2 close (removes from M2 = no-op) -> fd1 AUTHMAGIC(N) -> 1-bit write into freed drm_file",
  "evidence": "findings/poc/DF-4972/ (this verdict; full chain in reviewer notes)",
  "kernel_refs": [
    "sys/dev/drm/drm_auth.c:65",
    "sys/dev/drm/drm_auth.c:87-90",
    "sys/dev/drm/drm_auth.c:148-149",
    "sys/dev/drm/drm_auth.c:285-286"
  ],
  "guest_uname": "",
  "code_hash": ""
}