{
 "finding_id": "DF-3145",
 "status": "reproduced",
 "reproduced": 1,
 "impact": "leak",
 "confidence": "certain",
 "verdict": "50 failed mounts of the crafted HPFS image (sp_cpinum=0x4000 so hpm_cpdblk = 16384 * sizeof(struct cpdblk), sp_cpi far past EOF so the first bread fails and hpfs_cpinit returns at hpfs_subr.c:286 without freeing) grew the M_HPFSMNT malloc zone from empty to 106M in-use with 200 allocations and zero frees - about 2MiB of cpdblk leaked per failed mount (plus the separately-known hpmp mount-failure leak, DF-0889 family). Caller cleanup only frees hpm_bitmap/hpm_bmind via hpfs_bmdeinit, never cpdblk. Privileged mount trigger; resource exhaustion only. Fix frees cpdblk on both error paths; compile-validated.",
 "exploit_chain": "",
 "evidence": "run.log: vmstat -m HPFS_mount line 0 -> 100 in-use / 106M after 50 failed mounts, mount attempts=50 failed=50",
 "kernel_refs": [
  "sys/vfs/hpfs/hpfs_subr.c:276",
  "sys/vfs/hpfs/hpfs_subr.c:283-286",
  "sys/vfs/hpfs/hpfs_subr.c:298-300"
 ],
 "poc_changes": "image adapted from the DF-3144 rig with sp_cpi = 0x40000 (bread fails immediately) instead of the livelock shape",
 "attempts": 1,
 "guest_uname": "DragonFly dfbsd 6.5-DEVELOPMENT #0: Thu Jul 2 06:02:54 UTC 2026 root@dfbsd:/usr/obj/usr/src/sys/X86_64_GENERIC x86_64",
 "runtime_sec": 60,
 "guest_dirty": 0,
 "build_cmd": "host: python3 craft_hpfs_err.py out.img",
 "run_cmd": "guest: vnconfig -c -S 8m /dev/vn1 img; loop 50x mount_hpfs -o ro /dev/vn1 /mnt; vmstat -m | grep HPFS",
 "code_hash": "b185ffaaf403ec11bf045e4c03e55de4a01842ba6ee8508d8fbf2a9d0360b7c1",
 "notes": "",
 "recommended_fix": "kfree hpm_cpdblk on both error returns"
}