DF-5228 VERDICT — dma_free_coherent() leaks every physical page

Status: REPRODUCED (impact: dos — permanent wired-memory exhaustion; also an orphaned-PTE hazard) on the stock /boot/kernel/drm.ko of the DragonFly 6.5-DEVELOPMENT guest.

Evidence chain (all from run.log, stock drm.ko)

1. Orphaned PTE: immediately after dma_free_coherent(p): pmap_kextract(p) = 0x03900000 / 0x03a00000 / 0x18000000 across runs — the kernel PTE stays valid after the KVA was handed back to kernel_map. Root cause: the contig region is mapped by pmap_kenter_noinval (vm_contig.c:531) over an object-less kmem_alloc_pageable entry (vm_kern.c:171-175); kmem_free → vm_map_delete only calls pmap_remove for object-backed entries (vm_map.c:3325-3370) — never for this one. vm_kern.c:311-313 warns about exactly this misuse.
2. Pages never released: PHYS_TO_VM_PAGE(pa)->wire_count == 1, queue == 0 — page STILL WIRED after the free (probe across both the reserve path, PG_FICTITIOUS=1, and the real-page path, PG_FICTITIOUS=0). vm_page_free_contig (vm_page.c:2858) is never called; the correct free is contigfree() (vm_contig.c:588-603).
3. Sustainability test: 60–120 cycles of dma_alloc_coherent(2MB) + dma_free_coherent(2MB) — with a correct free this must be loss-free forever. Observed on stock drm.ko: - v2 run: plateau for the first ~60 cycles (the 128MB DMA reserve being silently drained — fictitious reserve pages are invisible to vmstats.v_free_count), then linear drain once the reserve is exhausted; 240MB cycled → 124MB permanent deficit, wire surplus 32200; - v3 run (reserve already exhausted): linear from cycle 1; 120MB cycled → 119MB permanent deficit, wire surplus 31199, with zero live allocations at the end.
4. Control: identical loop with contigmalloc/contigfree → deficit 0–77 pages (sampling noise; 400:1 signal-to-noise).

Impact

Every dma_free_coherent() call permanently burns its pages (wired → never reclaimed, even under full memory pressure) plus reserve capacity shared with all other contig consumers (network rings, sound, USB). Live triggers: radeon_gart_fini (per driver unload / failed probe — the GART table is 64KB–MBs), amdgpu_ih_ring_fini ×1–3 rings per amdgpu teardown (kldunload / re-probe), TTM DMA pools. Root/hardware lifecycle triggered → Medium.

The orphaned PTE (KVA returned to kernel_map while a valid PTE to a wired page persists) additionally leaves the map/pmap out of sync — vm_kern.c:311 warns resident_count is mistabulated in this situation.

No uid=0 chain (resource-exhaustion class). Panic was never needed; the primitive is directly observable.

Fix validation (same run environment)

fix.diff (shared with DF-5227): dma_free_coherent = contigfree(cpu_addr, size, M_DEVBUF). Guest reset (vm.sh reset with-src), fix applied, drm.ko rebuilt and loaded on the fresh boot; identical PoC re-run (run.fixed.log):

• pmap_kextract(va) = 0 → kernel PTE properly removed;
• 120MB of alloc+free cycles → deficit 2 pages (noise), wire surplus 2 (vs 30691/31199 on stock);
• allocations still succeed → no functional regression.

Notes

• v1 of the PoC mis-measured (vmstats deltas are invisible while the reserve absorbs the leak) — v2/v3 instruments (page-state probe + sustainability loop + control) were written after observing the reserve behavior; all three baseline runs are kept in run.log.
• kldunload drm (stock, no device attached) hung the guest's linker subsystem once; pre-existing drm teardown defect family (DF-4532/DF-5064), unrelated to this finding (linux_dma.c code paths are not involved in module teardown). The fix-validation run avoided unload (fresh boot).
• Guest reset clean after evidence collection.

Fix status (batch validation)

Applied with the 36 sibling fix.diffs of this batch in findings/poc/_batch41/all_fixes.patch; single in-guest make -j6 nativekernel KERNCONF=X86_64_GENERIC completed RC=0 with zero errors under -Werror (full log: findings/poc/_batch41/fix_build8.log). Behavior A/B intentionally skipped for this Info-tier item.