# DF-5686 VERDICT

## Status: REPRODUCED (kernel heap leak per UDEVPROP getdevs ioctl; root-gated direct trigger, devd-triggered on default systems) — FIXED by fix.diff (validated on rebuilt kernel)

## Reproduction (baseline kernel #0, as root — /dev/udev is 0600)
500 × ioctl(/dev/udev, UDEVPROP, {"command":"getdevs"}):

  before:  proparay 1.97K InUse / 378K    prop_array 1.96K InUse / 251K
  after:   proparay 2.46K InUse / 472K    prop_array 2.45K InUse / 876K

Delta for 500 ioctls: **+490 proparay, +490 prop_array InUse, +625 KB** —
one leaked array-of-all-cdevs (~1.3 KB) per call, plus one permanent
reference on every cdev's si_dict per call (unobservable in vmstat but
strictly implied by the missing release: refcounts grow without bound, so
device dicts outlive device destruction).

Idle-session observation (no PoC running): proparay/prop_array InUse crept
1→9 over ~10 minutes — devd(8)'s own getdevs polling leaking on a default
install.

## Fix validation (patched kernel #1, `prop_object_release(ctx.cdevs)` added at kern_udev.c:1013)
500 ioctls as root:
  before:  proparay 2 / 384B    prop_array 0 InUse
  after:   proparay 2 / 384B    prop_array 0 InUse
FLAT — leak eliminated.

## kernel_refs
sys/kern/kern_udev.c:985, 992, 1004-1008, 1011-1014
sys/libprop/prop_kern.c:585-590 (prop_dictionary_copyout_ioctl consumer contract)

## Fix status (batch validation)
Applied with the 36 sibling fix.diffs of this batch in findings/poc/_batch41/all_fixes.patch; single in-guest `make -j6 nativekernel KERNCONF=X86_64_GENERIC` completed RC=0 with zero errors under -Werror (full log: findings/poc/_batch41/fix_build8.log). Behavior A/B intentionally skipped for this Info-tier item.