# DF-3334 — netmap_mem_get_info() failure paths unbalance the adapter refcount

**Target:** `sys/net/netmap/netmap.c:1331-1333` (NIOCGINFO, reference LEAK)
and `sys/net/netmap/netmap.c:1398-1402` (NIOCREGIF, premature
`netmap_adapter_put` → refcount underflow → **UAF**).

## NIOCREGIF (the dangerous one)

`netmap_get_na()` (netmap.c:1377) acquires a reference that
`netmap_do_regif()` then *takes ownership of* (`priv->np_na = na`,
netmap.c:1209; the dtor drops it once at netmap.c:657).  If
`netmap_mem_get_info()` fails right after a *successful* registration,
the error path calls `netmap_adapter_put(na)` **again** — one drop too many.
On fd close, `netmap_dtor()` drops it a second time → refcount hits 0 while
`WNA(ifp)` still points at the adapter → **use-after-free** for the whole
interface (next NIOCGINFO/NIOCREGIF/ifunit traffic on that ifp derefs freed
memory; driver detach double-frees).

## NIOCGINFO (the leak)

Mirror image: on the same `netmap_mem_get_info()` failure after a successful
`netmap_get_na(create=1)`, the code `break`s **without** any
`netmap_adapter_put(na)` → one pinned reference per call (and each call with
a fresh interface name attaches a *new* generic adapter whose if_input hook
can then never be removed).

## Trigger gating (why Low/likely)

`netmap_mem_get_info()` (netmap_mem2.c:198-219) fails when
`nmd->config(nmd)` returns nonzero — `netmap_mem_global_config()`
(netmap_mem2.c:798-828) returns a **sticky** `nmd->lasterr` that is set by
any earlier failed `netmap_config_obj_allocator()` /
`netmap_finalize_obj_allocator()` (ENOMEM under memory pressure), or
directly by root via the RW sysctls `dev.netmap.{if,ring,buf}_{size,num}`
(netmap_mem2.c:146-159).  Unprivileged reachability therefore needs a prior
allocator failure (plausible under memory pressure, not deterministic);
with the sysctl it is trivially root-triggered.  Additionally, on current
DragonFly the whole netmap subsystem does not compile (see DF-3332/env.txt),
so the bug is latent until the subsystem is resurrected.

## Verification

Phase V skipped (Low severity, latent trigger, subsystem does not build on
this tree — see verdict.json).  Analysis is line-verified:
references are balanced on every other error path of both ioctls
(checked line-by-line in VERDICT.md).