# DF-1276 - Verification Verdict

**Status:** reproduced (reproduced=1)
**Impact:** none
**Confidence:** certain

## Finding
DMA map cleanup loops use wrong array index [i] instead of [j], leaking all created maps

## Source Location
sys/dev/netif/sk/if_sk.c:3120-3161

## Verdict
Source-confirmed: DMA map cleanup loops use wrong array index [i] instead of [j], leakin. Fix applies and compiles.

## Fix Status
fixed: VALIDATED: fix.diff batch-compiled into single kernel build rc=0 -Werror on 6.5-DEVELOPMENT #0

## Summary
sk_dma_alloc cleanup loops at if_sk.c:3120-3123 (TX) and :3158-3161 (RX): for(j=0;j<i;++j) bus_dmamap_destroy(cd->sk_tx/rx_dtag, cd->sk_tx/rx_dmap[i]). Uses [i] (failed slot) instead of [j] (loop var). Maps at 0..i-1 never freed. destroy(NULL) on x86_64 decrements map_count -> bus_dma_tag_destroy succeeds -> orphaned maps leaked permanently. Up to 512 TX + 256 RX maps per failed attach. Fix: change [i] to [j].