=== baseline run (unpatched stock modules) — uid 65534 ===
$ su -m nobody -c /tmp/leak_trigger
[leak_trigger] uid=65534 pid=1296 got dmabuf fd=3 (refs: 1 from dma_buf_export/falloc + 1 from fd table)
[leak_trigger] closing fd=3; after this NO ONE holds the buffer in userland or kernel except the orphaned export ref
[leak_trigger] check: orphan f_count=1 => LEAK: struct file + dma_buf never freed (repro)
LEAK_RC=2

=== kernel-side (dmesg) ===
dmabug: demo module loaded (drm.ko provides dma_buf_export/dma_buf_fd)
dmabug: mkfd: uid=65534 dmabuf=0xfffff8008d981f98 file=0xfffff8011738c900 fd=3 f_count=2 (expect 2: falloc + fd-table)
dmabug: check: dmabuf=0xfffff8008d981f98 file=0xfffff8011738c900 f_count=1 (fd closed, no other owner exists; >=1 => LEAK, 0/freed => ok)

=== classification ===
file alive at f_count=1 with zero owners after the only user closed the fd  => reproduced / leak (kernel memory + fd-table exhaustion path)