# DF-5101 — drm_irq.c irq_enabled test-and-clear race (hardening)

## What this is
An **Info-severity hardening finding** filed from the pass-2 audit of
`sys/dev/drm/drm_irq.c`. The PoC for this pack is a **reachability probe**:
the race has no in-tree unprivileged trigger and this audit guest has no DRM
device at all, so the honest verdict is `inconclusive` (feature absent on
guest), not `reproduced`/`not_reproduced`.

## The claim (static, proven by inspection)
* `drm_irq_uninstall()` (`sys/dev/drm/drm_irq.c:182-183`) does a **non-atomic,
  lock-inconsistent test-and-clear** of `dev->irq_enabled`.
* One caller takes `dev->struct_mutex` (root ioctl path, `drm_irq.c:257-259`),
  another caller takes **no lock at all** (`drm_legacy_dev_reinit()` in
  `sys/dev/drm/drm_file.c:541-543` runs `drm_irq_uninstall()` *before* taking
  `struct_mutex`), and driver load/unload paths take neither.
* If two callers ever race past the flag check, both execute
  `driver->irq_uninstall()` + `free_irq(dev->irq, dev)`.
* The DF `free_irq()` shim (`sys/dev/drm/linux_irq.c:108-141`) performs its
  list lookup **without holding `irqdata_lock`** (the lock is only taken for
  the list removal *after* the teardown at lines 129-135 already ran), so two
  racing callers can both "find" the entry and double-execute
  `bus_teardown_intr()` / `bus_release_resource()` / `kfree(irq_entry)` —
  a latent double-free/UAF.

## Why it is only Info (gating, all verified in-tree)
1. `DRM_IOCTL_CONTROL` is `DRM_AUTH|DRM_MASTER|DRM_ROOT_ONLY`
   (`sys/dev/drm/drm_ioctl.c:623`), and `DRM_ROOT_ONLY` is enforced with
   `capable(CAP_SYS_ADMIN)` at `sys/dev/drm/drm_ioctl.c:538` → the ioctl
   uninstall path needs root.
2. That ioctl path *and* the `drm_lastclose` → reinit path both early-out for
   non-`DRIVER_LEGACY` drivers (`sys/dev/drm/drm_irq.c:238-239`,
   `sys/dev/drm/drm_file.c:570-571`). **No in-tree driver sets
   DRIVER_LEGACY**: radeon kms_driver (`radeon_drv.c:669-672`), amdgpu
   (`amdgpu_drv.c:1303-1305`) and i915 (`i915_drv.c:3284-3285`) are all
   KMS-only.
3. Remaining callers are module load/unload/resume paths, single-threaded in
   practice and root-gated (i915 `i915_drv.c:699` / `intel_display.c:16197`;
   radeon `radeon_irq_kms.c:318/339`; amdgpu `amdgpu_irq.c:274/302`).

## Reproduce (probe)
```
./run.sh        # or: dfbsd-qemu/vm.sh run_root '...probe commands...'
```
No build step (`build.sh` documents that). Expected on the standard audit
snapshot: **no `/dev/dri` or `/dev/drm` nodes, no DRM modules on disk, only
the QEMU std VGA device (chip 0x11111234) that no DRM driver claims** →
neither install nor uninstall of a DRM irq handler is reachable at runtime on
this guest.