# DF-3279 — VERDICT

**REPRODUCED — deterministic kernel memory leak (root-gated).**

## Evidence (baseline kernel, before fix)

```
$ vmstat -m | grep -E "^ *devbuf"   (before)
             devbuf   24.6K   3.12M       0    390M    49.1K
$ ./span_leak 20000                  (20000 spanport add/del cycles)
$ vmstat -m | grep -E "^ *devbuf"   (after)
             devbuf   44.2K   5.40M       0    390M    88.2K
```

Delta: +2.28 MB / 20000 cycles ≈ **114 bytes leaked per cycle** —
matching `sizeof(struct bridge_ifinfo)` plus allocator rounding.

## Root cause

`bridge_ioctl_addspan()` (if_bridge.c:1823):
`bif_info = kmalloc(sizeof(*bif_info), M_DEVBUF, M_WAITOK | M_ZERO);`
assigned to `bif->bif_info` (if_bridge.c:1828).  Nothing else
references it (span bifs are never passed to `bridge_delete_member`;
the span branch of `bridge_ioctl_gifs()` at if_bridge.c:1482-1493
doesn't touch `bif_info`).  `bridge_delete_span()` kfrees only `bif`
— the `bif_info` is orphaned.  Both the ioctl path and the
ifnet-detach path (`bridge_ifdetach_dispatch`, if_bridge.c:1900-1904)
go through `bridge_delete_span`, so both leak.

## Impact

Unbounded kernel heap exhaustion by repeated `BRDGADDS`/`BRDGDELS`
cycles — requires root (both ioctls are `BC_F_SUSER`-gated), so this
is a resource-leak bug (Low) rather than a privilege issue.  A
long-running host where automation adds/removes span ports (e.g. per-
session port mirroring) slowly bleeds unrecoverable kernel memory
until reboot.

## Fix validation

`fix.diff` (free `bif_info` in `bridge_delete_span`) applied with the
combined patch; on the rebuilt kernel the same 20000-cycle loop left
devbuf in-use unchanged (see run_fixed.log).

## Fix status (batch validation)
Applied with the 36 sibling fix.diffs of this batch in findings/poc/_batch41/all_fixes.patch; single in-guest `make -j6 nativekernel KERNCONF=X86_64_GENERIC` completed RC=0 with zero errors under -Werror (full log: findings/poc/_batch41/fix_build8.log). Behavior A/B intentionally skipped for this Info-tier item.