========== LIVE SMB REACHABILITY CHECK ==========
Guest: DragonFly 6.5-DEVELOPMENT #0 (with-src, INVARIANTS ON)

Evidence:
- smbfs.ko EXISTS and is loadable (kldload smbfs succeeds)
- smb_iod_recvall IS in smbfs.ko symbols (offset 0x86f0, type 't' = local text)
- mount_smbfs binary available at /sbin/mount_smbfs
- /dev/nsmb device exists (root-only: crwx------ root wheel)
- SMB_TCP_PORT = 139 (hardcoded in smb.h:43)

Source trace (sys/netproto/smb/smb_iod.c:353-378):
- smb_iod_recvall loops calling SMB_TRAN_RECV to receive mbufs
- For each received SMB message, searches iod_rqlist for matching MID
- First response for MID: md_initm transfers ownership (line 359)
- Duplicate response for same MID with md_top already set and not
  MULTIPACKET: else branch at lines 363-366 breaks WITHOUT freeing m
- Post-loop m_freem at line 377 gated on rqp==NULL which is FALSE
  after a match at line 355 -> m is LEAKED

Runtime trigger attempt:
- Built evil_smb_dup.c: malicious SMB1 server that sends duplicate responses
- Server accepts TCP connections on port 139
- Handles NBSS session setup, NEGOTIATE, SESSION_SETUP correctly
- For post-mount requests: sends TWO identical responses in one write()
- BUT: mount_smbfs HANGS after SESSION_SETUP response
  - Server log shows NEGOTIATE + SESSION_SETUP processed
  - No TREE_CONNECT received from client
  - mount_smbfs enters D state (uninterruptible wait)
  - Issue: SESSION_SETUP response format doesn't satisfy NTLMSSP auth flow
  - The client expects either anonymous auth acceptance or NTLMSSP challenge

Bug classification: source-confirmed memory leak (DoS). The bug IS real
  (code path traced line by line). Runtime trigger requires a fully
  functional SMB1 server that correctly handles the NTLMSSP authentication
  exchange, which is complex to implement in a standalone C server.
  The threat model is a malicious SMB server (network attacker position)
  that a victim mounts via mount_smbfs.