{
  "finding_id": "DF-5190",
  "status": "untested",
  "reproduced": false,
  "impact": "none",
  "confidence": "speculative",
  "verdict": "vmalloc()/vzalloc()/vmalloc_user() (sys/dev/drm/linux_vmalloc.c:107-124) are implemented as plain kmalloc(M_DRM), violating the Linux vmalloc contract (page-aligned, whole-page, exclusively-owned zeroed pages). The only in-tree consumer of the user-mappable property is the legacy _DRM_SHM path (drm_bufs.c:244 handle = vmalloc_user(size), mmap sink drm_vm.c:130 vtophys(handle+offset)), and that sink is unreachable: drm_mmap() looks maps up by raw byte offset (drm_vm.c:91) while map-hash keys are page numbers (drm_bufs.c:98), so the lookup fails before vtophys() is ever reached (independently re-derived here; corroborates pass-1 DF-5122 unreachable on every shipped driver). Additionally drm_bufs.c:173-174 PAGE_ALIGNs _DRM_SHM sizes and M_ZERO zeroes the full (page-multiple) chunk, so even a revived sink would not disclose intra-chunk slack. No demonstrable impact today; filed as Info/speculative to document the hazard for any future revival of the legacy mmap dispatch or newly ported code that mmaps vmalloc_user() memory page-wise. Verification skipped per reviewer contract for Info-tier findings; guest has no /dev/dri anyway. Sibling candidate kvmalloc_array SIZE_MAX/0 divide-by-zero was empirically refuted on the shipped drm.ko (kld call returned ZERO_LENGTH_PTR, no divq in the disassembly) and is recorded in negative-kvmalloc-div0.txt, not filed.",
  "exploit_chain": "",
  "evidence": "VERDICT.md (contract analysis + why the drm_vm.c:130 sink is dead); negative-kvmalloc-div0.txt (guest transcript + objdump of shipped drm.ko kvmalloc_array showing mul/jo instead of divq); fix.diff (kmem-backed reimplementation)",
  "kernel_refs": [
    "sys/dev/drm/linux_vmalloc.c:107",
    "sys/dev/drm/linux_vmalloc.c:113",
    "sys/dev/drm/linux_vmalloc.c:119",
    "sys/dev/drm/linux_vmalloc.c:127",
    "sys/dev/drm/drm_bufs.c:244",
    "sys/dev/drm/drm_bufs.c:173",
    "sys/dev/drm/drm_vm.c:91",
    "sys/dev/drm/drm_vm.c:130",
    "sys/dev/drm/drm_bufs.c:98"
  ],
  "poc_changes": "n/a - no PoC seed existed; this is a code-trace finding. The kvmalloc_array guest experiment (not a finding) used a 30-line kld built in-guest against /usr/src.",
  "attempts": 0,
  "guest_uname": "DragonFly dfbsd 6.5-DEVELOPMENT DragonFly 6.5-DEVELOPMENT #0: Thu Jul  2 06:02:54 UTC 2026     root@dfbsd:/usr/obj/usr/src/sys/X86_64_GENERIC  x86_64",
  "runtime_sec": 0,
  "guest_dirty": 0,
  "build_cmd": "",
  "run_cmd": "",
  "code_hash": "",
  "notes": "Info-tier finding: Phase V skipped per contract (no Critical/High severity, no memcorrupt/privesc bucket, no unprivileged trigger). Guest reset with-src after the kvmalloc experiment. Routed lead from radeon_prime (vmp leak when kmem_alloc_nofault returns 0, linux_vmalloc.c:53-59) confirmed accurate by inspection but is verbatim pass-1 DF-2190 - no new ID allocated, no duplicate filed.",
  "recommended_fix": "Back the vmalloc family with page-aligned wired kmem (kmem_alloc3 + explicit zeroing + size registry for vfree) instead of kmalloc - see fix.diff",
  "fix_status": "not_testable",
  "fix_baseline_reproduced": false,
  "fix_patched_reproduced": false,
  "fix_verdict": "Fix not validated on the guest: the finding has no runnable trigger (sink path dead, no DRM device on guest), so no baseline exists to compare a patched kernel against. fix.diff is a compile-reviewed proposal only.",
  "fix_evidence": "n/a"
}