# DF-3522 — ng_bridge constructor leaks `priv->tab` when `ng_make_node_common` fails

**Status: untested (Low/Info-severity error-path leak; no PoC per the
audit contract's skip rule for Info findings). Confidence: certain
(code).**

`sys/netgraph/bridge/ng_bridge.c`, constructor:

```c
:310  priv->tab = kmalloc(MIN_BUCKETS * sizeof(*priv->tab), M_NETGRAPH,
:311                      M_NOWAIT | M_ZERO);
:312  if (priv->tab == NULL) {
:313          kfree(priv, M_NETGRAPH);
:314          return (ENOMEM);
:315  }
...
:324  if ((error = ng_make_node_common(&ng_bridge_typestruct, nodep))) {
:325          kfree(priv, M_NETGRAPH);      /* <-- priv->tab NOT freed */
:326          return (error);
:327  }
```

At `:325` the successfully-allocated `priv->tab` (32 * sizeof(struct
ng_bridge_bucket) = 256 bytes) is leaked. Reachability: the only
non-ENOMEM failure of `ng_make_node_common` is "type not registered"
(ng_base.c:386) — impossible for our own registered type — or its
internal node `kmalloc` failure (M_NOWAIT), i.e. effectively
KMALLOC-failure-only. Impact: negligible in practice (256 B under
extreme memory pressure); filed for completeness since pass 1 missed it
and the fix is one line:

```diff
--- a/sys/netgraph/bridge/ng_bridge.c
+++ b/sys/netgraph/bridge/ng_bridge.c
@@ -322,6 +322,7 @@
 	/* Call superclass constructor */
 	if ((error = ng_make_node_common(&ng_bridge_typestruct, nodep))) {
+		kfree(priv->tab, M_NETGRAPH);
 		kfree(priv, M_NETGRAPH);
 		return (error);
 	}
```

## Files

* `VERDICT.md` (this file) — no binary PoC (Info severity).

## Fix status (batch validation)
Applied with the 36 sibling fix.diffs of this batch in findings/poc/_batch41/all_fixes.patch; single in-guest `make -j6 nativekernel KERNCONF=X86_64_GENERIC` completed RC=0 with zero errors under -Werror (full log: findings/poc/_batch41/fix_build8.log). Behavior A/B intentionally skipped for this Info-tier item.

(No fix.diff for this item: documented recommendation only - see Fix above.)