# DF-3349 -- verification pack

**Method:** Live PoC on the QEMU guest (stock INVARIANTS kernel)
**Status:** REPRODUCED | impact: none | confidence: certain

## What this is
lacp_port_destroy never releases the slow-protocols membership / ifma caller reference (if_delmulti_ifma compiled out, lacp.c:584-591): after -laggport the membership persists (PF_ROUTE trace shows NEWMADDR with no DELMADDR) and the ifma allocations leak PERMANENTLY - 20 create/port/remove/destroy cycles grew ether_multi in-use from 38 to 78 (+2 per cycle, surviving interface destroy; the leaked objects also keep ifma_ifp pointing at freed ifnets).

## Build
```
cc -O -o <prog> <prog>.c   (on the guest)
```

## Run
```
(driver script)
```
(success criterion: see VERDICT.md)

## Evidence
live3.log lacp section: NEWMADDR with no DELMADDR; ether_multi 38 -> 78 after 20 cycles

Kernel references: sys/net/lagg/ieee8023ad_lacp.c:584-591, sys/net/lagg/ieee8023ad_lacp.c:530-551, sys/net/if.c:2667-2684