DF-0752 — mbuf leak evidence (netstat -m samples)
====================================================

All samples are `netstat -m | head` on the guest. The MPLS route table was
EMPTY in every run (no label route installed), so every MPLS frame with a
non-reserved label hits the route-not-found path in mpls_forward().

================================================================================
UNPATCHED MPLS kernel  (6.5-DEVELOPMENT #1, built 2026-07-09 09:03, NO fix.diff)
Kernel sha256: b31400ab0725fad1628bc362965048fd78a98d2a4f2920ec3d6d23a456aeff98
================================================================================

--- small flood: 1000 frames, label=1000 ---
BEFORE: 7/146632 mbufs in use
AFTER : 1007/146632 mbufs in use        delta = +1000  (exactly 1 mbuf/packet)

--- full flood: 20000 frames, label=1000 (see baseline_run.txt) ---
BEFORE: 1009/146632 mbufs in use  (7 baseline + 1000 leftover from small flood)
AFTER : 21007/146632 mbufs in use       delta = +20000 (exactly 1 mbuf/packet)

LEAK RATE: exactly 1 mbuf leaked per unroutable-label MPLS packet.
mbuf pool cap = 146632, so ~7 such floods of 20000 exhaust the pool => DoS.

================================================================================
FIXED MPLS kernel  (6.5-DEVELOPMENT #1, built 2026-07-09 09:31, WITH fix.diff)
Kernel sha256: 8d5bb36d23252e1b71b9ca2b46c8f971561dbdb4e83a1e1e54aef6fdc4909d09
================================================================================

--- flood: 20000 frames, label=1000 (see fix_run.txt) ---
BEFORE: 8/146632 mbufs in use
AFTER : 7/146632 mbufs in use           delta = -1 (noise; NO leak)

--- flood: 40000 frames, label=1000 (see fix_run2.txt) ---
BEFORE: 8/146632 mbufs in use
AFTER : 7/146632 mbufs in use           delta = -1 (noise; NO leak)

--- second flood: 40000 frames, label=1000 (see fix_run2.txt) ---
AFTER2: 7/146632 mbufs in use           delta =  0 (NO leak)

TOTAL post-fix: 100000 unroutable-label MPLS frames delivered, ZERO mbuf growth.