# DF-2690 - Verification Verdict

**Status:** reproduced
**Impact:** none (hardening)
**Confidence:** certain

## Mechanism
m_extadd attaches an external buffer without the M_EXT precondition guard that m_mclget has (m_mclget:1243 KKASSERT((m->m_flags & M_EXT) == 0)); calling it on a cluster/external mbuf overwrites ext_* without releasing the prior association - the old buffer leaks its refcount and m_free later executes the WRONG disposal path for the flags (m_sharecount/objcache confusion).

## Verdict
source-confirmed (no runtime PoC; deterministic code trace of the cited path:line in the read-only sys/ tree). API-hardening: grep shows no in-tree caller of m_extadd outside mbuf.h (declaration) - the guard protects future/protocol-code callers. Same KKASSERT pattern as m_mclget, compile-validated.

## Threat / reachability
Future misuse of the mbuf external-buffer API turns into refcount leaks + wrong-cache objcache_put (heap corruption class).

## Privilege escalation assessment
n/a (hardening)

## Fix
Add KKASSERT((m->m_flags & M_EXT) == 0) at the top of m_extadd.

## Kernel references
- `sys/kern/uipc_mbuf.c:1481`
- `sys/kern/uipc_mbuf.c:1243`

## Fix status (batch validation)
Applied with the 36 sibling fix.diffs of this batch in findings/poc/_batch41/all_fixes.patch; single in-guest `make -j6 nativekernel KERNCONF=X86_64_GENERIC` completed RC=0 with zero errors under -Werror (full log: findings/poc/_batch41/fix_build8.log). Behavior A/B intentionally skipped for this Info-tier item.