DF-4471 — wrapper-less __drm_helper_disable_unused_functions NULLs crtc->primary->fb without dropping its reference

File: sys/dev/drm/drm_crtc_helper.c (pass 2; upstream v4.15-identical).

No runnable PoC — pure reference-accounting defect, hardware-gated the same way as DF-4469/DF-4470 (needs radeon/amdgpu + a mode configuration with a temporarily-unused CRTC), and the observable effect (fb/GEM object pinned past destroy) needs kernel introspection to see. Verified by code trace:

Reference protocol

"crtc->primary->fb owns exactly one framebuffer reference" — established
by __drm_mode_set_config_internal (drm_crtc.c:474-498): before set_config
every plane->old_fb is snapshotted; after it, get(new plane->fb) /
put(old_fb).  Any pointer the helper leaves behind is balanced there.

The defect

sys/dev/drm/drm_crtc_helper.c:181-191
__drm_helper_disable_unused_functions():
    if (!crtc->enabled) {
            ...
            crtc->primary->fb = NULL;     /* line 189: NO put() */
    }

Inside set_config the wrapper's put(old_fb) balances the lost pointer
(get is skipped for the NULL).  But two in-tree callers invoke the
function WITHOUT the wrapper:

  * drm_helper_resume_force_mode()   — drm_crtc_helper.c:983
  * drm_helper_disable_unused_functions() (exported) — drm_crtc_helper.c:219
    (used by drm_fb_helper.c, radeon_device.c, radeon_fb.c,
    amdgpu_device.c, amdgpu_fb.c — resume + fbdev-restore paths)

Each such call drops the plane's fb pointer and leaks its reference:
the drm_framebuffer and its GEM bo can never be freed (memory leak;
DRM_IOCTL_MODE_RMFB of that fb id will also keep reporting it alive).
Repeated suspend/resume cycles (laptop lid events) repeat the leak.

Severity: Low (leak only, safe direction, needs the unused-CRTC state and driver-initiated paths; an unprivileged console user can at most influence vt/fbcon restore frequency).

Fix

Track and drop the reference at the NULL assignment site:

--- a/sys/dev/drm/drm_crtc_helper.c
+++ b/sys/dev/drm/drm_crtc_helper.c
@@ -184,9 +184,11 @@ static void __drm_helper_disable_unused_functions(struct drm_device *dev)
            if (crtc_funcs->disable)
                (*crtc_funcs->disable)(crtc);
            else
                (*crtc_funcs->dpms)(crtc, DRM_MODE_DPMS_OFF);
+           if (crtc->primary->fb)
+               drm_framebuffer_put(crtc->primary->fb);
            crtc->primary->fb = NULL;
        }
    }
 }

…and remove the matching put from the set_config wrapper accounting, or
(simpler policy fix) make the wrapper tolerate the changed refs by
snapshotting counts rather than pointers.

DF-4471 — __drm_helper_disable_unused_functions drops primary->fb without its reference

See README.md (contains the full writeup; no separate VERDICT narrative is warranted for this Low/leak-only, code-proven accounting defect — the reference protocol derivation and the balanced-callers analysis are there).

Verification: not attempted on the guest (Low severity, leak-only, and the guest has no DRM device). Status: untested. Fix: fix.diff.

Fix status (batch validation)

Applied with the 36 sibling fix.diffs of this batch in findings/poc/_batch41/all_fixes.patch; single in-guest make -j6 nativekernel KERNCONF=X86_64_GENERIC completed RC=0 with zero errors under -Werror (full log: findings/poc/_batch41/fix_build8.log). Behavior A/B intentionally skipped for this Info-tier item.