=== BASELINE (unfixed) — 20000 rounds ===
$ ./poc_leak 20000
graph built + unit READY; dropping to nobody
uid=65534 euid=65534
round 0
round 2000
...
(serial console, same run):
Warning: objcache(netgraph) exhausted on cpu0!
ng_hci_mtap: hci0 - Could not forward packet, error=12
ng_hci_process_event: hci0 - got HCI event=0x5, length=4
...
=> run never completed; guest wedged (ssh dead). Leak confirmed: drained
   conq items never return to the netgraph item objcache.

=== FIXED (one-line DRAIN fix) — 3000 rounds ===
$ ./poc_leak 3000
SET_DEBUG e=0 errno=0(0) debug_now=9
drained 4 bytes from drv after command
state(+300..1200ms) = 0x5
bdaddr = 00:00:00:00:00:00
buffer: cmd_free=1 acl=256,0,0 sco=256,266,0
graph built + unit READY; dropping to nobody
uid=65534 euid=65534
round 0
round 2000
done: 3000 rounds (queued=yes)
EXIT=0
$ vmstat -m | grep netgraph
           netgraph       7    1008       0    390M        7
$ dmesg | grep -c 'objcache(netgraph) exhausted'
0
=> item count flat (7), zero exhaustion warnings, guest healthy.

=== FIXED — 20000 rounds ===
run completed; guest healthy; netgraph malloc count 6-7 flat;
0 exhaustion warnings. (See run.2.log summary in VERDICT.md)