# DF-2265 verification pack — sasetparams ENODEV ccomp leak

Bug: `sys/bus/cam/scsi/scsi_sa.c:2938-2941` — the compression-
unsupported ENODEV exit frees mode_buffer and releases the ccb but never
frees `ccomp` (allocated at :2757), leaking one sa_comp_t (16 bytes,
M_SCSISA) per failed MTCOMP ioctl on drives reporting the DATA
COMPRESSION page without the DCC bit.

## Rig

Same harness kernel as DF-2263 (see ../DF-2263/README.md); the REAL
`sasetparams()` and `sagetparams()` run against a fake transport
(`cam_periph_runccb` interposed) that answers MODE SENSE(6) with a DCP
page lacking DCC — the drive class the in-tree comment anticipates.
Trigger equals saioctl(MTIOCTOP, MTCOMP) at :1266. Leak measured via
in-kernel sums of M_SCSISA->ks_use[cpu].{memuse,calls}.

## Build

    ./build.sh      # or reuse the kernel built from ../DF-2263

## Run

    vm.sh run_root 'sysctl debug.df226x.t2265=1000'
    vm.sh run_root 'dmesg | grep DFH2265'

## Expected

Unpatched: `memuse grew by 16000 bytes = 1000 x sizeof(sa_comp_t) (16)`
after 1000 ENODEV returns (3 allocation calls per iteration, one object
never freed). Patched (fix.diff adds `kfree(ccomp, M_SCSISA);` on the
ENODEV path): `memuse grew by 0 bytes`.

Artifacts: VERDICT.md, df_pre.c, df_post.c, gen.sh, build.sh, quick.sh,
run_unfixed.dmesg, run_fixed.dmesg, env.txt (in ../DF-2263), fix.diff.