# DF-5187 — default drm_gem_dumb_map_offset returns offsets from the wrong address space (latent, dead in-tree)

## What

The **default** `drm_gem_dumb_map_offset` (reached from
`drm_mode_mmap_dumb_ioctl`'s else branch, sys/dev/drm/drm_dumb_buffers.c:128)
returns

```c
*offset = drm_vma_node_offset_addr(&obj->vma_node);   /* drm_gem.c:401 */
```

the raw **vma-offset-manager** address (`drm_mm` region starting at
`DRM_FILE_PAGE_OFFSET_START` = 0x100000 pages = 1<<40 bytes — drm_gem.c:119-160).
But the DragonFly mmap resolver for the DRM cdev only understands the legacy
**hash-key** form:

```c
if ((offset & DRM_GEM_MAPPING_MASK) != DRM_GEM_MAPPING_KEY)   /* 2ULL<<62 */
        return (NULL);                                        /* drm_gem.c:1070 */
offset &= ~DRM_GEM_MAPPING_KEY;
drm_ht_find_item(&mm->offset_hash, DRM_GEM_MAPPING_IDX(offset), ...)
```

and the hash key lives in a **different allocator** (`mm->idxunr`,
drm_gem.c:153) than the vma node's page index — two independent namespaces
grafted together in this port.  i915's own override returns the correct form
(`DRM_GEM_MAPPING_OFF(obj->base.map_list.key) | DRM_GEM_MAPPING_KEY`,
i915_gem.c:2647-2648), which is what everything actually uses.

Consequences for any driver relying on the default:

1. the MAP_DUMB offset lacks the KEY bits → `mmap()` on it returns `ENODEV`
   (dumb buffers unmap-able — functional bug);
2. nothing in the default path establishes the correspondence the resolver
   assumes (vma page index vs idxunr key), so the two namespaces can disagree
   about which object an offset denotes — the same mis-wiring that gives
   DF-5186's race its wrong-object resolution power.

## Scope

**Latent**: all three in-tree KMS drivers override `.dumb_map_offset`
(amdgpu_drv.c:1322, i915_drv.c:3301, radeon_drv.c:693), so no in-tree path
uses the default.  Info severity; filed so the port's dual-namespace mmap
plumbing is on record and because any out-of-tree/currently-unwired GEM driver
that trusts the default hands out unmappable (or mis-resolving) offsets.

## Fix

Return the hash-key form exactly like i915 (fix.diff).  Not verified at
runtime (no in-tree consumer; no DRM device on the audit guest) — hence
status `untested`.