{
  "finding_id": "DF-5122",
  "status": "untested",
  "reproduced": false,
  "impact": "none",
  "confidence": "certain",
  "verdict": "Static structural finding, proven by source citation, with no runtime trigger on any stock system: drm_mmap() (drm_vm.c:44-139) is unreachable because vm_mmap() prefers d_mmap_single and only falls back to the old device pager on ENODEV (vm_mmap.c:1372-1386), while drm_mmap_single() never returns ENODEV for any shipped driver (all set DRIVER_GEM: i915_drv.c:3284, radeon_drv.c:671, amdgpu_drv.c:1304; radeon/amdgpu also set drm_ttm_bdev). Inside this dead handler are three latent defects beyond the known DF-2124/2126: (1) the map_hash lookup passes a byte offset where keys are page numbers (drm_vm.c:91 vs drm_bufs.c:98,511-512); (2) phys = map->offset + offset / vtophys(handle + offset) double-counts the user token instead of rebasing by it (drm_vm.c:121,130); (3) the DMA branch returns a byte address where the consumer old_dev_pager_fault (device_pager.c:360) requires a PFN via pmap_phys_address()=ptob(ppn) (pmap.c:5985-5989) - inconsistent with atop() at drm_vm.c:137. Triage value: DF-2124 and DF-2126 live in this dead path; DF-2125 (fictitious helpers, drm_vm.c:141-227) IS live at runtime (registered at i915_gem_gtt.c:2968 / radeon_device.c:1493 / amdgpu_device.c:2648, consulted per GPU VM fault at ttm_bo_vm.c:667 and i915_gem.c:2391) and is not downgraded.",
  "exploit_chain": "",
  "evidence": "findings/poc/DF-5122/VERDICT.md (full reachability proof with path:line); README.md; env.txt shows the guest has no DRM hardware (pciconf: only bochs vgapci 0x1234:1111, /dev/dri absent), so no runtime PoC is possible even for the live paths",
  "kernel_refs": [
    "sys/dev/drm/drm_vm.c:44-139",
    "sys/dev/drm/drm_vm.c:91",
    "sys/dev/drm/drm_vm.c:121",
    "sys/dev/drm/drm_vm.c:74",
    "sys/dev/drm/drm_vm.c:137",
    "sys/dev/drm/drm_bufs.c:98",
    "sys/dev/drm/drm_bufs.c:352-365",
    "sys/dev/drm/drm_bufs.c:511-512",
    "sys/dev/drm/drm_drv.c:1154-1155",
    "sys/dev/drm/drm_drv.c:1256-1274",
    "sys/vm/vm_mmap.c:1372-1386",
    "sys/vm/device_pager.c:329-332",
    "sys/vm/device_pager.c:360",
    "sys/platform/pc64/x86_64/pmap.c:5985-5989",
    "sys/dev/drm/i915/i915_drv.c:3284",
    "sys/dev/drm/radeon/radeon_drv.c:671",
    "sys/dev/drm/amd/amdgpu/amdgpu_drv.c:1304"
  ],
  "poc_changes": "No PoC exists: the finding is a reachability/correctness proof, fully verified statically. Guest lacks any Intel/AMD GPU, so /dev/dri never exists (env.txt).",
  "attempts": 0,
  "guest_uname": "DragonFly dfbsd 6.5-DEVELOPMENT DragonFly 6.5-DEVELOPMENT #0: Thu Jul 2 06:02:54 UTC 2026\troot@dfbsd:/usr/obj/usr/src/sys/X86_64_GENERIC\t x86_64",
  "runtime_sec": 0,
  "guest_dirty": 0,
  "build_cmd": "",
  "run_cmd": "",
  "code_hash": "7c8c36788ee20b1a28bc9483017fb5b115d7841133ba42f1796d76c39f913fc1 (sha256 of README.md, the analysis artifact)",
  "notes": "Info-class hardening/triage finding; PoC skipped per contract (Low/Info). Status untested reflects: no runtime verification applicable (dead path + no GPU on guest). fix.diff is advisory (corrected key scale, token rebase, map->size bound, atop() on the DMA branch) with deletion of the handler recommended instead.",
  "recommended_fix": "Delete the dead legacy d_mmap handler (drop .d_mmap = drm_mmap from drm_cdevsw); if a non-GEM/non-TTM legacy driver is ever ported, fix the key scale, rebase by user_token, bound by map->size, and return atop(phys) on all branches (see fix.diff).",
  "fix_status": "not_testable",
  "fix_baseline_reproduced": 0,
  "fix_patched_reproduced": 0,
  "fix_verdict": "Fix not built: the affected path is unreachable on every shipped driver and the guest has no DRM hardware, so neither baseline nor patched behavior is observable at runtime.",
  "fix_evidence": "findings/poc/DF-5122/fix.diff (advisory, annotated)"
}