{
  "finding_id": "DF-5162",
  "title": "bktr_mem stored-address registry is never invalidated when the METEORSETGEO grow path frees the frame buffer — driver reload reinstalls the freed KVA, bzeros ~3.5 MB and RISC-DMAs video into reallocated kernel memory (write-after-free)",
  "verdict": "not_reproduced",
  "impact": "none",
  "reproduce": {
    "build": "cc -O2 -Wall -o grow_stale grow_stale.c",
    "run": "./grow_stale  (unprivileged) ; then as root: sh reload_stale.sh",
    "expected": "on Bt848/878 hardware: grow ioctl accepted (registry now holds freed KVA); after kldunload/kldload of bktr the re-attach reinstalls the OLD address and bzero()s it; capture then corrupts whatever occupies that KVA. On this guest: open(/dev/bktr0) -> ENOENT (no device)."
  },
  "kernel_refs": [
    "sys/dev/video/bktr/bktr_mem.c:55", "sys/dev/video/bktr/bktr_mem.c:64",
    "sys/dev/video/bktr/bktr_mem.c:103", "sys/dev/video/bktr/bktr_mem.c:115",
    "sys/dev/video/bktr/bktr_mem.c:142",
    "sys/dev/video/bktr/bktr_core.c:382", "sys/dev/video/bktr/bktr_core.c:415",
    "sys/dev/video/bktr/bktr_core.c:1667", "sys/dev/video/bktr/bktr_core.c:1669",
    "sys/dev/video/bktr/bktr_core.c:429", "sys/dev/video/bktr/bktr_core.c:432",
    "sys/dev/video/bktr/bktr_os.c:325", "sys/dev/video/bktr/bktr_os.c:362"
  ],
  "artifacts": [
    "grow_stale.c", "reload_stale.sh", "build.sh", "run.sh",
    "build.log", "run.log", "env.txt",
    "fix.diff", "README.md", "VERDICT.md", "manifest.json", "verdict.json"
  ]
}