# DF-3406 — tapwrite mbuf leak on EFAULT (one m_get per failed write)

## Reproduce (guest, as root)

    cc -O2 -o tapleak tapleak.c
    netstat -m | head -3
    ./tapleak 100000
    netstat -m | head -3     # stock: +100,000 data mbufs (~50 MB)
                              # fixed: unchanged

Creates a tap unit, opens it, and issues 100,000 write()s whose
buffer crosses into a PROT_NONE page, so uiomove faults part-way
(EFAULT) after at least one successful mbuf fill — the exact
condition that leaks the spare MGET at if_tap.c:961.

**Expected (stock kernel):** mbuf count grows by exactly 1 per
failed write and never returns. **Fixed kernel:** no growth.