Line-accurate confirmation (boot-time only; demo would require
failing root-mount candidates at boot - disproportionate for Info):
sys/kern/vfs_conf.c:435-462 candidate loop: on VFS_MOUNT failure the
   next iteration overwrites mp via vfs_rootmountalloc without
   teardown; each failed candidate leaks a struct mount with its
   LIVE syncer kernel thread (mount_init -> vn_syncer_thr_create,
   sys/kern/vfs_mount.c:380-390), shared-locked mnt_lock, mnt_hold=1
sys/kern/vfs_conf.c:505-511 final error path kfrees the last mp but
   never drops mp->mnt_vfc->vfc_refcount (contrast :375 in
   vfs_mountroot_devfs) -> fstype permanently pinned, module unload
   refused by vfsconf_remove
Bounded by candidate count; root/loader-driven only.