# Fact Check Report

Start time: Sat Apr 25 14:29:43 PDT 2026  
Git call budget used: 12 / 20  

---

## Verified

- **Commit `e753c16cb3dd`** resolves correctly; subject "Merge tag 'spi-fix-v7.0-rc7' of
  git://git.kernel.org/pub/scm/linux/kernel/git/broonie/spi" matches report's abbreviated
  "Merge tag 'spi-fix-v7.0-rc7'". ✓
- **Commit `611e12ea0f121`** resolves (full SHA `611e12ea0f121a31d9e9c4ce2a18a77abc2f28d6`);
  subject "i2c: core: manage i2c bus device refcount in i2c_[get|put]_adapter" matches
  verbatim. ✓
- **`lib/refcount.c:25`** crash site — tree line 25 is
  `REFCOUNT_WARN("addition on 0; use-after-free");` which is the `REFCOUNT_ADD_UAF` case.
  Crash location is correct. ✓
- **`lib/kobject.c` lines 636–646** (`kobject_get`) — all lines match tree verbatim. ✓
- **`drivers/i2c/i2c-core-base.c` lines 2602–2619** (`i2c_get_adapter`) — all lines match
  tree verbatim. ✓
- **`include/linux/refcount.h:366`** — `__refcount_add(1, r, oldp)` (body of
  `__refcount_inc`). ✓
- **`include/linux/refcount.h:383`** — `__refcount_inc(r, NULL)` (body of `refcount_inc`). ✓
- **`include/linux/kref.h:45`** — `refcount_inc(&kref->refcount)` (body of `kref_get`). ✓
- **`REFCOUNT_ADD_UAF = 2`** — confirmed by enum definition at `include/linux/refcount.h:117`;
  order is: 0=REFCOUNT_ADD_NOT_ZERO_OVF, 1=REFCOUNT_ADD_OVF, 2=REFCOUNT_ADD_UAF,
  3=REFCOUNT_SUB_UAF, 4=REFCOUNT_DEC_LEAK. RBX=0x2 correctly identified as REFCOUNT_ADD_UAF. ✓
- **RAX = RIP − 7** claim: 0xffffffff849eaa6f − 7 = 0xffffffff849eaa68 = RAX value in Key
  Elements table. ✓
- **Register values consistent** — RBX=0x2, RDI=0xffffffff8f74abf0, R14=0xffff88803b531188
  all match Key Elements table. ✓
- **File paths** verified to exist at PATCH_BASE `e753c16cb3dd`:
  `lib/refcount.c`, `lib/kobject.c`, `drivers/i2c/i2c-core-base.c`,
  `drivers/i2c/i2c-dev.c`, `include/linux/refcount.h`, `include/linux/kref.h`,
  `arch/x86/entry/entry_64.S`, `arch/x86/entry/syscall_64.c`,
  `fs/char_dev.c`, `fs/open.c`, `fs/namei.c`. ✓

---

## Whitespace / cosmetic fixes applied

1. **`drivers/i2c/i2c-dev.c` `i2cdev_open` code block (§7)** — Line numbers 607–618 were
   off by +7. A comment block at tree lines 607–613 was omitted without `...` notation,
   causing the remaining lines (`client = kzalloc_obj(*client)` through closing `}`) to
   be mis-numbered. Corrected to 614–625 (all offsets within ±10). Also fixed indentation
   to match tree.  
   *Cosmetic fix: line numbers off by 7.*

2. **`drivers/i2c/i2c-core-base.c` `i2c_del_adapter` code block (§ How/A1)** — Lines
   1800–1815 contained variable offsets (1–9 lines) caused by blank lines and an expanded
   FIXME comment in the tree being truncated in the report. Corrected line numbers:
   `i2c_host_notify_irq_teardown` 1800→1801, `debugfs_remove_recursive` 1801→1803,
   `init_completion` 1805→1812, `device_unregister` 1806→1813,
   `wait_for_completion` 1807→1814, `mutex_lock` 1810→1817, `idr_remove` 1811→1818,
   `mutex_unlock` 1812→1819, `memset` 1814→1823, `}` 1815→1824.
   All offsets within ±10.  
   *Cosmetic fix: line numbers off by 1–9.*

3. **Analysis section `i2c_get_adapter` code block (§ What)** — All source indentation was
   stripped (no `  NNNN\t` prefix, no tab indentation). Restored to `  NNNN\t` + verbatim
   source line format matching the backtrace section style. Annotation comments preserved.  
   *Cosmetic fix: indentation/whitespace (re-run pass).*

4. **Analysis section `i2c_del_adapter` code block (§ How/A1)** — All source indentation
   was stripped (no `  NNNN\t` prefix, no tab indentation). Restored to `  NNNN\t` + verbatim
   source line format. Elision annotation lines (no line-number prefix) preserved as-is.
   Content of line 1811 (`* FIXME: This is old code ... */`) remains incorrect per prior
   ⚠️ flag — only formatting was restored, content not rewritten.  
   *Cosmetic fix: indentation/whitespace (re-run pass).*

---

## Doubts flagged

- ⚠️ **`lib/refcount.c` code quote mismatch** (`report.md` §0 `refcount_warn_saturate`,
  claimed range lines 18–25, file `lib/refcount.c` at `e753c16cb3dd`):  
  The report shows two fallthrough pairs:
  - `case REFCOUNT_ADD_NOT_ZERO_OVF: case REFCOUNT_ADD_OVF:` (lines 18–19) sharing one
    `REFCOUNT_WARN` call (line 20)
  - `case REFCOUNT_ADD_UAF: case REFCOUNT_SUB_UAF:` (lines 22–23) sharing one
    `REFCOUNT_WARN` call (line 24/25)

  The actual tree has **four independent cases**, each with its own `REFCOUNT_WARN` and
  `break`:
  - line 18: `case REFCOUNT_ADD_NOT_ZERO_OVF:` → WARN at 19, break at 20
  - line 21: `case REFCOUNT_ADD_OVF:` → WARN at 22, break at 23
  - line 24: `case REFCOUNT_ADD_UAF:` → WARN at 25 (**crash line — correct**)
  - line 27: `case REFCOUNT_SUB_UAF:` → WARN at 28 ("underflow; use-after-free"), break at 29

  The crash line (25) and crash text are correct. Lines 18–23 contain wrong code content
  (the fallthrough structure does not exist in the source). Code block **not rewritten** per
  fact-checker rules; mismatch noted here and in `report.md`.

---

## Email discrepancies (analysis-email.txt, not edited)

No `analysis-email.txt` found in the report directory — not checked.

---

## Not checked

- `drivers/base/core.c` `get_device` function quote (in `collected.md` — not present as a
  named backtrace section in `report.md`; no code block with line numbers to check).
- `fs/char_dev.c:411`, `fs/open.c:949/1081/1366/1372/1383/1388`,
  `fs/namei.c:4677/4836/4865`, `arch/x86/entry/syscall_64.c:63/94`,
  `arch/x86/entry/entry_64.S:121` — file paths verified present; individual line
  numbers not verified (these are VFS/syscall boilerplate and are not in the detailed
  backtrace source sections of `report.md`).
- `do_file_open` at `fs/namei.c:0` — line 0 in backtrace.json (DWARF sparse); not
  checkable.
- Patch diff in `report.md` (§ Where) — excluded per fact-checker scope rules.

---

## Source of truth used

- Git tree: `/sdb1/arjan/git/oops-skill/oops-workdir/linux` at `e753c16cb3dd`
- Key Elements table in `report.md`
- `backtrace.json` (inlined frames and function source lines)