# DF-3210 — krpc_call() early-error exits leak the caller's request mbuf chain; nfs_mountrpc.c's "message already freed" ownership contract is false

Files: `sys/vfs/nfs/krpc_subr.c:213-265,275-276,437-441` (callee defect) manifesting at
`sys/vfs/nfs/nfs_mountrpc.c:146-166, 252-259` (callers).

## What
`krpc_call()` only chains the caller's request mbuf (`*data`) onto `mhead` at krpc_subr.c:275-276. Every error
exit **before** that point (`socreate` :220-221, `sosetopt(SO_RCVTIMEO)` :231-232, `sobind` :263-265) jumps to
`out:` where only `mhead` (NULL) and `from` (NULL) are freed — the request chain is leaked. After chaining,
all exits free it via `m_freem(mhead)`.

The callers encode the opposite assumption:
* `md_mount` v3 attempt (nfs_mountrpc.c:143-147): on error it falls into the v2 branch and **reassigns** `m`
  at :160 without freeing — leaks the v3 request chain when krpc_call exited early.
* `md_mount` v2 (nfs_mountrpc.c:163-166): `return error; /* message already freed */` — comment false on
  early exits.
* `md_lookup_swap` (nfs_mountrpc.c:252-259): same `return error; /* message already freed */`.

## Severity honesty
Bounded leak: at most one chain (1-2 mbufs) per failed call, ≤3 calls per boot → ≤ ~6 mbufs. The triggering
failures (socreate/sosetopt/sobind with all 512 swept reserved ports busy) are practically unreachable in the
single-threaded early-boot context. No UAF, no double-free (verified: after a *post-chaining* error exit the
request is freed exactly once as part of m_freem(mhead), and callers never dereference `m` after a failed
krpc_call before reassignment — :146→:160 and :258-259). Filed as Info: real defect, no demonstrated impact.

## Ceiling
Boot-path only (`#if BOOTP||NFS_ROOT`); audit guest boots hammer2 from disk, `nfs_mountroot` never runs —
same not-runtime-testable ceiling as DF-3203/3204/3205.