# DF-3490 - VERDICT

**status: inconclusive | reproduced: 0 | impact: none | confidence: certain**

Not testable at runtime on this guest (no USB Bluetooth dongle can be attached to attach/detach ng_ubt nodes; malicious-USB threat model). Line-accurate confirmation: ubt_detach() (ng_ubt.c:684-713) drains sc_cmdq/sc_aclq/sc_scoq via NG_BT_MBUFQ_DESTROY but never frees sc->sc_isoc_in_buffer and never clears it - the only other reference in the file is ubt_isoc_read_one_frame() retaining it (:1113, :1178); grep of the whole tree shows no other user. Every attach/detach cycle that leaves a partial SCO frame in the reassembly mbuf therefore leaks one mbuf+cluster (~2KB) permanently; repeated hotplug cycles drive toward mbuf exhaustion. ng7 ubt is compiled into the DF verification harness kernel (NETGRAPH7_BLUETOOTH_UBT) to prove the file builds and the fix.diff applies (see build.log in the harness kernel log); runtime leak not exercised - no device.

## Kernel references
- sys/netgraph7/bluetooth/drivers/ubt/ng_ubt.c:684
- sys/netgraph7/bluetooth/drivers/ubt/ng_ubt.c:1113
- sys/netgraph7/bluetooth/drivers/ubt/ng_ubt.c:1178

## Evidence
source excerpt ng_ubt.c:684-713 (detach) and :1113/:1178 (retention), harness kernel build.log (module compiled in)

## Recommended fix
NG_FREE_M(sc->sc_isoc_in_buffer) under UBT_NG_LOCK in ubt_detach() (and clear on disconnect).

## Fix status (batch validation)
Applied with the 36 sibling fix.diffs of this batch in findings/poc/_batch41/all_fixes.patch; single in-guest `make -j6 nativekernel KERNCONF=X86_64_GENERIC` completed RC=0 with zero errors under -Werror (full log: findings/poc/_batch41/fix_build8.log). Behavior A/B intentionally skipped for this Info-tier item.