# DF-0489 — NA handler route refcount leak — FALSE POSITIVE

## Result
**NOT REPRODUCED — FALSE POSITIVE.** No refcount leak exists.

The finding claims `nd6_na_input` leaks a route refcount per NA because
`nd6_lookup` acquires a reference (`route.c:276` `++`) and `nd6_na_input` never
calls `rtfree()`. The reviewer **missed `nd6.c:929`** (`rt->rt_refcnt--`), which
sits inside `nd6_lookup` itself and unconditionally balances the `++` before the
route is returned. Net reference change to the caller = **zero**.

## Key citations
- `sys/netinet6/nd6_nbr.c:734` — `rt = nd6_lookup(&taddr6, 0, ifp);` (create=0)
- `sys/netinet6/nd6.c:873` — `rtpurelookup` → `_rtlookup` → `route.c:276` `++`
- `sys/netinet6/nd6.c:929` — `rt->rt_refcnt--;` **(the guard the reviewer missed)**
- `git blame`: line 929 is in commit `6cc80ee9` (same as the rest of the audited file).

## Reproduce
```
./build.sh && ./run.sh
```
`run.sh` prints the code trace. The empirical injectors (`poc_df0489.c` BPF,
`poc_df0489_ng.c` netgraph) are included for completeness; BPF writes are TX
(`bpf.c:598`), and the netgraph `NGIOCSETNAME` ioctl is unsupported on this build,
so neither could exercise the RX input path. The **source trace is the definitive
proof** — see `VERDICT.md`.

## Fix
None — false positive. No `fix.diff`.