DF-4195 evidence pack — drm_connector_register/unregister kdev lifecycle hazard

Latent double-free (re-register after failed register) + unchecked kzalloc NULL-deref in the DFBSD sysfs stub. Low severity, source-certain, reachability speculative (no in-tree retry path; OOM-gated).

Contents: VERDICT.md full narrative with path:line citations fix.diff NULL the kdev on remove; check kzalloc in add manifest.json / verdict.json

No runtime PoC: guest has no DRM device (see ../DF-4194/env.txt) and neither branch is reachable in-tree today. Status: untested.

DF-4195 — drm_connector_register/unregister kdev lifecycle hazard (dangling pointer, latent double-free)

sys/dev/drm/drm_connector.c — pass 2, Low, code-certain / reachability speculative.

The issue

On the error path of drm_connector_register() (sys/dev/drm/drm_connector.c:453-467), a late_register (or, where compiled in, debugfs) failure unwinds through drm_sysfs_connector_remove() (sys/dev/drm/drm_sysfs.c:48-55), which does kfree(connector->kdev) without clearing connector->kdev, and leaves registration_state == DRM_CONNECTOR_INITIALIZING (line 441 gates progress; the REGISTERED assignment at line 461 is never reached).

Two consequences in the combined drm_connector.c + drm_sysfs.c lifecycle:

1. Re-register leaves REGISTERED with a dangling kdev. If any driver ever calls drm_connector_register() again on such a connector, state is still INITIALIZING, so the function proceeds — but drm_sysfs_connector_add() (drm_sysfs.c:37) early-returns on the stale non-NULL connector->kdev ("already added"), the connector is marked REGISTERED with a freed kdev, and the eventual drm_connector_unregister() → drm_sysfs_connector_remove() performs kfree() on the already-freed pointer → double free. In-tree today no driver retries register on a failed connector (grep of all drm_connector_register( call sites: drm_connector_register_all at device registration once; MST hotplug paths register each connector once after creation), so this is a latent API hazard, not a demonstrated in-tree trigger — hence Low / speculative reachability.
2. Unchecked kzalloc NULL-deref in the stub drm_sysfs_connector_add() (drm_sysfs.c:41-44): connector->kdev = kzalloc(...); connector->kdev->kobj.name = kasprintf(...) dereferences the unchecked allocation → NULL-deref panic under kernel memory pressure (device registration / MST hotplug).

Fix

fix.diff: clear connector->kdev = NULL after kfree in drm_sysfs_connector_remove(), and check the kzalloc result in drm_sysfs_connector_add() (return -ENOMEM).

Verification

Not runtime-verified: the audit guest has no DRM device (env.txt in the DF-4194 pack), the re-register path has no in-tree caller, and the NULL-deref needs an OOM at registration. Recorded as Low with source-level certainty.

Fix status (batch validation)

Applied with the 36 sibling fix.diffs of this batch in findings/poc/_batch41/all_fixes.patch; single in-guest make -j6 nativekernel KERNCONF=X86_64_GENERIC completed RC=0 with zero errors under -Werror (full log: findings/poc/_batch41/fix_build8.log). Behavior A/B intentionally skipped for this Info-tier item.