EVDI allocates primary/cursor plane structures with kmalloc, but its destroy callback only runs drm_plane_cleanup, which leaves the containing allocation to the driver. Device teardown therefore leaks both plane allocations. Run DRM cleanup and then kfree in the driver callback.

The KUnit regression observes native frees through the real EVDI device lifecycle, with valid query controls and 130 invalid/out-of-range plane-ID queries through DRM_IOCTL_MODE_GETPLANE before teardown. Probe identities retire before address reuse; unregister synchronization fences context release. The test fails on current main and passes with this fix.

Validation:

• Linux 6.15 KVM: unchanged regression fails before and passes after; KASAN/UBSan and lockdep/kmemleak runs pass without diagnostics.
• New production callback: GCC gcov reports 4/4 executable lines covered (100%), two calls. This is changed-function coverage, not whole-repository coverage.
• Module builds pass against installed 7.0.0-34-generic and 7.0.0-38-generic headers.
• Repository clang-format (18.1.3) passes for the new test; installed checkpatch 0.32 reports no errors and one generic new-file/MAINTAINERS warning. This repository has no MAINTAINERS file.

The template's downloading CI scripts were not run; the installed offline build/style equivalents above were used. The full historical kernel matrix, SonarQube complexity measurement and physical host rollout are not validated here. The production callback is straight-line cleanup. The update-ready handshake is unchanged.