{
 "finding_id": "DF-3166",
 "status": "not_reproduced",
 "reproduced": 0,
 "impact": "leak",
 "confidence": "certain",
 "verdict": "Both leaks are line-certain from source: the udf_mountfs bail path at :393-395 frees udfmp but never udfmp->s_table, which udf_find_partmaps allocates before any late mount failure (invalid sparing table, readlblks failure, multiple type-2 maps leak all but the last), and udf_vget at :535-538 kfrees unode but leaks unode->fentry kmalloced at :528 when udf_allocv fails. A dynamic demonstration requires a crafted UDF image with a valid sparable-partition map that fails later in mount (root file-entry corruption); building a UDF forger exceeded this batch budget, and the udf_vget half additionally requires an allocation failure. Fix frees both; compile-validated in the combined build.",
 "exploit_chain": "",
 "evidence": "VERDICT.md walk over udf_vfsops.c:393-395/:528/:535-538 and udf_find_partmaps :662/:684-687",
 "kernel_refs": [
  "sys/vfs/udf/udf_vfsops.c:393-395",
  "sys/vfs/udf/udf_vfsops.c:528",
  "sys/vfs/udf/udf_vfsops.c:535-538",
  "sys/vfs/udf/udf_vfsops.c:662"
 ],
 "poc_changes": "",
 "attempts": 2,
 "guest_uname": "DragonFly dfbsd 6.5-DEVELOPMENT #0: Thu Jul 2 06:02:54 UTC 2026 root@dfbsd:/usr/obj/usr/src/sys/X86_64_GENERIC x86_64",
 "runtime_sec": 60,
 "guest_dirty": 0,
 "build_cmd": "n/a (UDF image forger out of batch budget)",
 "run_cmd": "n/a",
 "code_hash": "",
 "notes": "",
 "recommended_fix": "free s_table in the bail path and fentry on the udf_allocv failure"
}