# DF-3088 verification

Kernel: DragonFly dfbsd 6.5-DEVELOPMENT #0: Thu Jul 2 06:02:54 UTC 2026 root@dfbsd:/usr/obj/usr/src/sys/X86_64_GENERIC x86_64

Attempted against the real kernel nfsd (rpcbind/mountd/nfsd running, tmpfs export): a malicious local TCP client sent 3,000 bursts of 16 pipelined SunRPC calls each, closing with SO_LINGER(1,0) to force RSTs. netstat -m accounting before/after is identical (7 mbufs in use, 263 data clusters, 0 denied/delayed) - the won-race leak window (:575-579 frees only the descriptor while nd_mrep/nd_nam2 stay allocated) was never crossed. Narrow window; no leak observed in this volume.

## Kernel references
- sys/vfs/nfs/nfs_syscalls.c:575
- sys/vfs/nfs/nfs_syscalls.c:781
- sys/vfs/nfs/nfs_syscalls.c:793

## Fix
See fix.diff.

## Fix status (batch validation)
Applied with the 36 sibling fix.diffs of this batch in findings/poc/_batch41/all_fixes.patch; single in-guest `make -j6 nativekernel KERNCONF=X86_64_GENERIC` completed RC=0 with zero errors under -Werror (full log: findings/poc/_batch41/fix_build8.log). Behavior A/B intentionally skipped for this Info-tier item.