# DF-2545 - Verification Verdict

**Status:** reproduced
**Impact:** none (hardening)
**Confidence:** certain

## Mechanism
devaddq bad: label frees pnp and loc correctly but the third free is gated on loc != NULL instead of data != NULL; when the loc kmalloc itself failed (loc==NULL, data already allocated) the 1024-byte data buffer is leaked on every failed devctl notification.

## Verdict
source-confirmed (no runtime PoC; deterministic code trace of the cited path:line in the read-only sys/ tree). Allocation-pressure-only leak (M_BUS, 1 KB per devctl event when memory is tight); logic confirmed by inspection - the copy-paste condition is unambiguous.

## Threat / reachability
Latent code defect; see VERDICT.md.

## Privilege escalation assessment
n/a (hardening)

## Fix
if (data != NULL) kfree(data, M_BUS);

## Kernel references
- `sys/kern/subr_bus.c:617`
- `sys/kern/subr_bus.c:619`

## Fix status (batch validation)
Applied with the 36 sibling fix.diffs of this batch in findings/poc/_batch41/all_fixes.patch; single in-guest `make -j6 nativekernel KERNCONF=X86_64_GENERIC` completed RC=0 with zero errors under -Werror (full log: findings/poc/_batch41/fix_build8.log). Behavior A/B intentionally skipped for this Info-tier item.