# DF-2574 — struct ngd_connection leaked in ng_device_disconnect (40 B of M_DEVBUF per cycle, unbounded)

* File: `sys/netgraph/ng_device.c`
* Line: 411 region — disconnect kfrees readq, destroys the cdev, unlinks
  the list entry, but never kfrees the connection allocated at :273
* Claim: ~40 bytes leaked per connect/disconnect cycle, repeatable
  without bound.

**VERIFIED REPRODUCED (impact: dos — heap exhaustion, confidence:
certain).** Measured with exact kernel M_DEVBUF accounting: +40 bytes and
+1 in-use allocation per cycle, perfectly linear over 100 / 20000 / 20000
in-kernel cycles and 500 userland ngctl cycles (40500 total, +1.62 MB
never reclaimed). The one-line fix (`kfree(connection, M_DEVBUF)` at the
end of disconnect) drives the delta to exactly zero with normal operation
unchanged.

**Reachability caveat (material):** dead code in the stock build system —
see VERDICT.md and the DF-2573 pack.

## Contents

* `VERDICT.md` — full narrative + measurement tables + fix validation
* `run.sh` (= `run_df2574_leak.sh`) — the leak measurement driver
* `run.leak.log`, `run.fix-validation.log` — untrimmed run logs
* rig sources shared with DF-2573 (`ngdpoc_shim_prepend.h`,
  `ngdpoc_append.c`, `gen_ngdpoc.sh`, `df_ngdpoc.c`, `ngdpoc_slab.diff`,
  `build.sh`, `run_fix_validation.sh`)
* `build.log`, `env.txt`, `dmesg.txt`
* `fix.diff` — the validated one-line fix

## Quick reproduce

```
./build.sh BASELINE
./run.sh                  # expect +40 B / +1 inuse per cycle, linear
./build.sh FIX            # push fix.diff to /tmp/fix.d first
./run_fix_validation.sh   # expect cycle 20000 -> inuse delta 0
```