# DF-3166 verification

Kernel: DragonFly dfbsd 6.5-DEVELOPMENT #0: Thu Jul 2 06:02:54 UTC 2026 root@dfbsd:/usr/obj/usr/src/sys/X86_64_GENERIC x86_64

## Bottom line

Both leaks are line-certain from source: the udf_mountfs bail path at :393-395 frees udfmp but never udfmp->s_table, which udf_find_partmaps allocates before any late mount failure (invalid sparing table, readlblks failure, multiple type-2 maps leak all but the last), and udf_vget at :535-538 kfrees unode but leaks unode->fentry kmalloced at :528 when udf_allocv fails. A dynamic demonstration requires a crafted UDF image with a valid sparable-partition map that fails later in mount (root file-entry corruption); building a UDF forger exceeded this batch budget, and the udf_vget half additionally requires an allocation failure. Fix frees both; compile-validated in the combined build.

## Kernel references
- sys/vfs/udf/udf_vfsops.c:393-395
- sys/vfs/udf/udf_vfsops.c:528
- sys/vfs/udf/udf_vfsops.c:535-538
- sys/vfs/udf/udf_vfsops.c:662

## Exploit chain
(none: availability/correctness finding; no privilege chain)

## Fix

free s_table in the bail path and fentry on the udf_allocv failure

See fix.diff in this directory (git-apply-able against the read-only sys/
tree; applied only inside the disposable verification guest).

## Reproduction

build: n/a (UDF image forger out of batch budget)

run: n/a

expected: n/a

## Notes on the PoC (what changed vs the finding sketch)

(none)

## Fix status (batch validation)
Applied with the 36 sibling fix.diffs of this batch in findings/poc/_batch41/all_fixes.patch; single in-guest `make -j6 nativekernel KERNCONF=X86_64_GENERIC` completed RC=0 with zero errors under -Werror (full log: findings/poc/_batch41/fix_build8.log). Behavior A/B intentionally skipped for this Info-tier item.