# VERDICT — DF-3396: analysis-only (module does not build on DragonFly)

## Root cause
`netmap_mem_rings_create()` (sys/net/netmap/netmap_mem2.c:918-993):
on allocation failure mid-way (either `netmap_ring_malloc` or
`netmap_new_bufs` failing for any ring) it jumps to `cleanup:` which
calls `netmap_free_rings(na)` (netmap_mem2.c:892-910).  That helper only
releases the **ring objects** back to the ring pool
(netmap_ring_free per ring); it never releases the **packet buffers**
whose indices sit in the successfully-allocated rings' slots
(`ring->slot[i].buf_idx`, allocated by netmap_new_bufs at :948/:977).

Contrast the correct teardown, `netmap_mem_rings_delete()`
(netmap_mem2.c:995-1016), which walks every slot and calls
`netmap_free_buf(na->nm_mem, ring->slot[i].buf_idx)` *before* freeing
the rings.

## Consequence (latent)
Each failed netmap_mem_rings_create permanently leaks
`nkr_num_slots * num_rings` buffers from the (global) NETMAP_BUF_POOL:
their bitmap bits stay clear ("in use") and objfree is never restored.
Repeated failing binds (e.g. rings too large for the current pool
configuration, or ring pool exhaustion after a sysctl resize) drain the
buffer pool until objfree hits 0 -> every subsequent netmap bind fails
with ENOMEM until reboot/module reload.  Memory-pressure DoS by an
unprivileged user with access to /dev/netmap, requiring only the ability
to trigger allocation failure repeatedly.

## Why no PoC
The netmap module does not build on this tree — verified concretely:
`cd /usr/src/sys/net/netmap && make` fails with
`netmap_kern.h:747:27: error: 'struct ifnet' has no member named
'if_unused7'` (15 errors, -Werror, EXIT=1) — see netmap_build.log.
The finding is therefore latent: it becomes reachable the moment the
module is fixed/ported.  Consistent with pass-1 DF-0546..DF-0550, which
were filed at analysis confidence for the same reason.

## Fix status (batch validation)
Applied with the 36 sibling fix.diffs of this batch in findings/poc/_batch41/all_fixes.patch; single in-guest `make -j6 nativekernel KERNCONF=X86_64_GENERIC` completed RC=0 with zero errors under -Werror (full log: findings/poc/_batch41/fix_build8.log). Behavior A/B intentionally skipped for this Info-tier item.