This seems incredible on mainline though. Current theory is ioctl for page flip seems to perhaps be leaking `struct drm_pending_vblank_event` (bleeding kmalloc-64 slabs). Perhaps a missing send_event* ... maybe based on vblank + async combination.
Turned out there were no locks around the atomic commit so it was only atomic if it page flipping was synchronous. If another commit came in it would clobber the commit obj and/or abandon the completion event. Vendor solution in the unholy fork was to disable async page flipping to a terrible performance hit. But they also actually fixed the bug later. :facepalm: