{
  "finding_id": "DF-5064",
  "verdict": "not_reproduced",
  "impact": "stale /dev/dri entry points into unloaded module memory (UAF-class) + unbounded drm_device leak; GPU + root-kldunload gated",
  "confidence": "certain",
  "reproduce": {
    "build": "cp patched drm_dragonfly.c /usr/src/sys/dev/drm/; cd /usr/src/sys/dev/drm && make   # rc=0",
    "run": "on GPU-equipped hardware: kldload i915kms; open /dev/dri/card0 (as user); kldunload i915kms; open /dev/dri/card0 again -> drm_minor_acquire succeeds (minor never unregistered) and dev->driver->open resolves into freed module text. Patched: second open fails ENODEV.",
    "expected": "vulnerable: stale minors stay openable after unload (UAF window for unprivileged users) + drm_device graph leaked per cycle. patched: drm_dev_unregister removes minors from the idr (ENODEV) and drm_dev_put frees the device graph."
  },
  "kernel_refs": [
    "sys/dev/drm/drm_dragonfly.c:250-296",
    "sys/dev/drm/i915/i915_pci.c:680-691",
    "sys/dev/drm/drm_drv.c:274-282",
    "sys/dev/drm/drm_sysfs.c:84-113",
    "sys/dev/drm/i915/i915_drv.c:3279-3313"
  ],
  "artifacts": [
    "README.md", "VERDICT.md", "fix.diff", "fix_build.log",
    "env.txt", "manifest.json", "verdict.json"
  ]
}