DF-4470 VERDICT — duplicate connector IDs leak one reference per successful modeset

Status: INCONCLUSIVE (arithmetic certain; guest lacks DRM device)

Root cause (path:line)

1. sys/dev/drm/drm_crtc.c:721-741 — drm_mode_setcrtc copies user connector IDs into connector_set[] with per-ID lookup and no de-duplication; set->num_connectors = crtc_req->count_connectors (line 749).
2. sys/dev/drm/drm_crtc_helper.c:626-630 c for (ro = 0; ro < set->num_connectors; ro++) { if (set->connectors[ro]->encoder) continue; drm_connector_get(set->connectors[ro]); /* once per SLOT */ }
3. Binding happens once per (dev-list) connector — not per array slot — at drm_crtc_helper.c:635-666 (connector->encoder = new_encoder). The reference protocol is "one reference while the encoder is bound" (comment at drm_crtc_helper.c:468, drop at drm_crtc_helper.c:469).
4. The surplus drop exists ONLY on the failure path (drm_crtc_helper.c:775-779); the success return at lines 755-757 has no put loop.

⇒ an unbound connector listed k≥2 times in set_connectors receives k gets and 1 binding: +(k−1) leaked references per successful setcrtc. A bound connector duplicated is balanced (get skipped, put skipped).

Impact: the kref on drm_connector never again reaches 0 after the connector is destroyed (DP MST unplug path, drm_connector_unregister+cleanup) — the connector object (plus its name string, property blobs) is leaked permanently. Bounded-per-call (no per-reference allocation), unbounded in call count; requires DRM master (local unprivileged user on a headless system). Upstream v4.15-identical; Linux master still carries the same get/put asymmetry (checked 2026-09).

The fail path is balanced for duplicates: k gets (step 2) vs k puts (lines 775-779 iterate the array), verified by tracing all four bound/unbound × dup/no-dup × success/fail combinations — only unbound-dup-success leaks.

Fix

De-duplicate in drm_mode_setcrtc (drm_crtc.c:721-741):

--- a/sys/dev/drm/drm_crtc.c
+++ b/sys/dev/drm/drm_crtc.c
@@ -729,6 +729,11 @@ int drm_mode_setcrtc(struct drm_device *dev, void *data,
            ret = -ENOENT;
            goto out;
        }
+       for (j = 0; j < i; j++) {
+           if (connector_set[j] == connector) {
+               ret = -EINVAL;  /* duplicate connector id */
+               goto out;
+           }
+       }
        DRM_DEBUG_KMS("[CONNECTOR:%d:%s]\n",
            connector->base.id,
            connector->name);

(and declare int j;) — or make the get loop in drm_crtc_helper.c idempotent per connector.

Attempts

• Guest build: build.log (same binary as DF-4469).
• Guest run: no /dev/dri → run.log (ENOENT).

Fix status (batch validation)

Applied with the 36 sibling fix.diffs of this batch in findings/poc/_batch41/all_fixes.patch; single in-guest make -j6 nativekernel KERNCONF=X86_64_GENERIC completed RC=0 with zero errors under -Werror (full log: findings/poc/_batch41/fix_build8.log). Behavior A/B intentionally skipped for this Info-tier item.