# DF-0627 PoC — mbuf leak on duplicate SMB responses

## Build
No client binary to build — the trigger is a **malicious SMB server** (network
attacker position) plus a victim that mounts its share. `build.sh` is a no-op
placeholder.

## Run / trigger (requires the malicious-server harness)
1. Run a malicious SMB1 server reachable from the guest.
2. Victim mounts the share: `mount_smbfs //user@evil/share /mnt` and issues any
   request that produces an outstanding MID (e.g. `touch /mnt/x`).
3. Server sends ONE valid reply for that MID, then a burst of K additional
   NetBIOS-framed SMB messages with the SAME MID.
4. Observe the leak: `ssh dfbsd 'netstat -m'` — mbuf count climbs by K (each up to
   128 KB). Sustained flooding → mbuf/memory exhaustion → panic.

## Expected (bug present)
`netstat -m` mbuf/memory use climbs monotonically with each duplicate; eventually
the kernel panics on mbuf exhaustion.

## Expected (FIXED)
Each duplicate's mbuf chain is freed in the `else` branch; `netstat -m` stays flat.

## Proof
The bug is proven by source tracing in `VERDICT.md` (the `else` branch at
`smb_iod.c:363-366` breaks without freeing `m`, and the post-loop `m_freem` at
`:377` is gated on `rqp==NULL` which is false after a match).