{
  "finding_id": "DF-5154",
  "status": "untested",
  "reproduced": false,
  "impact": "none",
  "confidence": "certain",
  "verdict": "Line-proven DMA-tag leak: dpt_pci_attach creates dpt->parent_dmat (dpt_pci.c:134-143) before dpt_init, but dpt_frees init_level teardown ladder (dpt_scsi.c:1172-1204) destroys only the objects dpt_init created (dccb/sg/buffer tags, sg maps, CCB DMA memory) - parent_dmat is destroyed nowhere in the driver (rg: created once at dpt_pci.c:143, consumed at dpt_scsi.c:1235/1356/1370, no bus_dma_tag_destroy call). On the dpt_init failure path (dpt_pci.c:151-156) the tag leaks permanently per failed attach. Untested: hardware-gated (guest pciconf has no 0x1044:0xa400 device, env.txt), no unprivileged trigger, no memory-safety consequence - bounded boot-time resource leak only. Info hardening completeness for the raid-family teardown story.",
  "exploit_chain": "",
  "evidence": "README.md (create-without-destroy trace), VERDICT.md section 1 (exhaustive rg reference check), fix.diff (git-apply-clean one-hunk destroy after dpt_free), env.txt. Decisive lines: sys/dev/raid/dpt/dpt_pci.c:143 vs dpt_scsi.c:1174-1202 switch ladder with no parent_dmat case.",
  "kernel_refs": [
    "sys/dev/raid/dpt/dpt_pci.c:134",
    "sys/dev/raid/dpt/dpt_pci.c:143",
    "sys/dev/raid/dpt/dpt_pci.c:151",
    "sys/dev/raid/dpt/dpt_scsi.c:1172",
    "sys/dev/raid/dpt/dpt_scsi.c:1235",
    "sys/dev/raid/dpt/dpt_scsi.c:1356",
    "sys/dev/raid/dpt/dpt_scsi.c:1370",
    "sys/dev/raid/dpt/dpt.h:986"
  ],
  "poc_changes": "no seed PoC existed; none authored - path unreachable without DPT hardware; the leak is directly readable from source (create without destroy), a harness would add nothing",
  "attempts": 1,
  "guest_uname": "DragonFly dfbsd 6.5-DEVELOPMENT #0: Thu Jul 2 06:02:54 UTC 2026 root@dfbsd:/usr/obj/usr/src/sys/X86_64_GENERIC x86_64",
  "runtime_sec": 0,
  "guest_dirty": 0,
  "build_cmd": "",
  "run_cmd": "",
  "code_hash": "",
  "notes": "hw-gated (DPT HBA + dpt_init failure). Distinct from DF-2151 (wrong-rid release) and complementary to DF-5153 (setup_intr path, where the tag also leaks because nothing at all is torn down); this finding covers the earlier dpt_init-failure path where dpt_free IS called but the glue-owned tag still leaks. Success path keeping the tag for device lifetime is intentional (no detach method).",
  "recommended_fix": "bus_dma_tag_destroy(dpt->parent_dmat) immediately after dpt_free(dpt) on the dpt_init-failure path (child tags already destroyed by dpt_free, so the ordering is legal).",
  "fix_status": "not_testable",
  "fix_baseline_reproduced": false,
  "fix_patched_reproduced": false,
  "fix_verdict": "fix.diff authored post-verification; git apply --check clean (single hunk, dpt_pci.c:150-156). Baseline not reproducible on the guest (no DPT HBA) so patched-kernel validation is not_testable.",
  "fix_evidence": "findings/poc/DF-5154/fix.diff; VERDICT.md section 4."
}