# DF-5105 — amdgpu_do_test_moves success path leaks every GTT test BO (pinned + reserved + referenced)

## What runs it
`amdgpu_test.c` is compiled into the stock `amdgpu.ko` (Makefile:63) and
`amdgpu_test_moves()` is called from `amdgpu_device_init()`
(amdgpu_device.c:2684-2686) **iff** the load-time module parameter
`amdgpu.amdgpu_testing & 1` is set (amdgpu_drv.c:85 default 0,
amdgpu_drv.c:192 mode 0444, i.e. root/boot-gated) and the GPU accel path is
up. No userspace trigger; root opts in at boot/module-load.

## Build
Nothing to compile — this is a kernel-path finding. The probe script talks to
the running kernel:

    ./build.sh      # no-op (copies probe.sh, no compilation)

## Run (inside the guest, as root)
    sh /root/df5105/probe.sh        # or ./run.sh via vm.sh

## Expected on an AMD-GPU-equipped host with amdgpu.testing=1
On success the loop at amdgpu_test.c:85-234 `continue`s (line 217) past the
error-only unwind labels (219-233); after the loop only `vram_obj` is
unpinned/unreserved/unreffed (236-240) and the *pointer array* is kfree'd
(242). The n created GTT BOs (each 1 MiB, pinned, reservation held, refcount
1) are never released — n ≈ (gart_size − overhead)/1MiB, i.e. essentially the
whole GTT. Second-order: their `amdgpu_bo_reserve()` locks are held forever,
so any later eviction/teardown path that tries to reserve them blocks.

## What this guest shows
This QEMU guest has **no AMD display adapter** (only the emulated bochs VGA
chip 0x11111234), so `amdgpu_device_init()` never runs and the test path is
unreachable here regardless of the parameter. The probe documents exactly
that: module loads, no device attaches. The leak itself is proven by direct
reading of sys/dev/drm/amd/amdgpu/amdgpu_test.c:85-242 (see VERDICT.md).

## Artifacts
- `probe.sh`   — the guest probe
- `run.log`    — full untrimmed probe output
- `env.txt`    — guest environment
- `VERDICT.md` — full narrative with line citations
- `fix.diff`   — post-loop unwind of gtt_obj[] (both paths safe)
- `verdict.json` / `manifest.json`