# DF-2995 — nfsrv_writegather leaks the first reply mbuf on malformed v3 filehandle length

## Build
```
cc -O -o /root/nfspoc nfspoc.c
```

## Setup
NFS server running; `sysctl vfs.nfs.gatherdelay_v3=5000` (write-gathering for
v3; stock default is 0 — the bug needs this knob > 0, e.g. write-performance
tuning).

## Run
```
netstat -m | head -3                       # baseline
NFSPOC_SRCPORT=813 /root/nfspoc writebadfh 300
netstat -m | head -3                       # +~600 mbufs, never freed
```

## Expected
Each v3 WRITE whose filehandle length word is neither 0 nor NFSX_V3FH leaks
~2 mbufs permanently (observed 8 -> 607 after 300 requests; control with
gatherdelay_v3=0 leaks exactly 0). Repeated at scale this exhausts the mbuf
zone (all further m_getl(M_WAITOK) block) — remote unauthenticated memory
exhaustion / nfsd-thread hang, gated on gatherdelay_v3 > 0.

## Root cause
sys/vfs/nfs/nfs_serv.c nfsrv_writegather():
- `NEGREPLYOUT(nfsm_srvmtofh(&info, nfsd, &nfsd->nd_fh, &error))` (line 1263):
  nfsm_srvmtofh returns -2 for a garbage fh length (nfsm_subs.c:946-950),
  and NEGREPLYOUT (nfsm_subs.h:114-122) then calls
  `nfsm_reply(&info, nfsd, slp, 0, &error)` which **builds reply #1** into
  info.mreq (nfs_rephead).
- Control then jumps to the local `nfsmout:` (line 1307) which —
  unconditionally — sets error=EIO and calls `nfsm_writereply(...)`
  (line 1311) → nfs_rephead again → **info.mreq is overwritten**: reply #1 is
  dropped without m_freem → leaked (an m_getl pkthdr mbuf per request; the
  request mbuf accounting adds a second).
- Every other entry into that nfsmout builds no prior reply, so only this
  path leaks.