VERDICT — DF-4318

Status: untested (kernel path) / model-logic-confirmed (guest) Impact: none on this guest (hardware-gated); code defect certain

Reproduced?

Not against the kernel: the trigger needs an AMD DCE8-class (Sea Islands / Bonaire / Kaveri / Kabini) dGPU driven by amdgpu, plus a failure inside dce80_construct(). The audit guest (DragonFly dfbsd 6.5-DEVELOPMENT, X86_64_GENERIC) has no AMD GPU — pciconf -l shows only QEMU hostbridge, IDE, virtio-net/blk and a generic VGA (0x11111234). amdgpu.ko exists in /boot/kernel but can never bind.

What was verified, on the guest:

1. Control-flow model proof (df4318.c, exact copy of the three-function flow) built with the guest's cc 8.3 [DragonFly] and run: the failure path ends with exactly one orphaned allocation (the pool) while destruct() reclaimed the children; the success path ends at zero live allocations. Output in run.log / build_and_run.log.

2. Line-by-line trace (static, cited): - dce80_resource.c:1052-1067 — pool = kzalloc(...); if (dce80_construct(...)) return &pool->base; … return NULL; — no kfree(pool) on the failure arm. Same shape at :1262-1277 (dce81) and :1468-1483 (dce83). - dce80_resource.c:1047-1049 — construct failure runs destruct(pool) (:726-796) which frees only the sub-objects (opps/transforms/ipps/mis/ tgs/engines/i2cs/stream_encs/clk_srcs/abm/dmcu/dccg/irqs/audios), never pool. - Caller core/dc.c:671-677 (dc_construct): on NULL it does goto fail; destruct(dc) — it never received the pointer, so nothing can free the orphan.

Trigger conditions (when hardware exists)

Any of, during amdgpu bind/hotplug: - sub-object kzalloc failure (OOM): tg (:974), mi (:982), ipp (:989), transform (:996), opp (:1003), aux engine (:1012), hw i2c (:1019), sw i2c (:1026), dccg (:931), dmcu (:941), abm (:951), clock sources (:895-914), dp clock source (:917) - dal_irq_service_dce80_create failure (:968-970) - resource_construct failure (audio create fail — dc_resource.c:235-238 — or virtual stream encoder fail — dc_resource.c:267-270)

Each failed bind leaks sizeof(struct dce110_resource_pool) (~1-2 KB: embedded resource_pool with 6/6/6/6/6/12/6/6/6/7/6 pointer arrays + dce110 members). Rebind/hotplug loops under memory pressure amplify it. No privilege boundary is crossed — this is a hardening-class leak.

Exploit chain

None (CWE-401 leak, not corruption). Ceiling: unbounded kernel heap consumption over repeated failing attaches on the affected GPU.

Fix validation

fix.diff adds kfree(pool) to the three failure arms (mirrors dce80_destroy_resource_pool's destruct(pool); kfree(pool); at :841-848). Not kernel-tested: guest lacks the hardware; the model proves the logic trivially — with the fix, failure path ends at 0 live allocations.

Conclusion

Code defect is certain (dead-simple missing free, three sites). Guest kernel-path reproduction untested (hardware absent). Severity Low.

Fix status (batch validation)

Applied with the 36 sibling fix.diffs of this batch in findings/poc/_batch41/all_fixes.patch; single in-guest make -j6 nativekernel KERNCONF=X86_64_GENERIC completed RC=0 with zero errors under -Werror (full log: findings/poc/_batch41/fix_build8.log). Behavior A/B intentionally skipped for this Info-tier item.