{
  "finding_id": "DF-3522",
  "status": "untested",
  "reproduced": 0,
  "impact": "none",
  "confidence": "certain",
  "verdict": "Info-severity error-path leak, no PoC per audit contract skip rule for Low/Info: ng_bridge_constructor frees priv but not the successfully allocated priv->tab (256 B) when ng_make_node_common fails (ng_bridge.c:324-326). Only reachable under KMALLOC failure; one-line fix.",
  "exploit_chain": "",
  "evidence": "VERDICT.md with code excerpt and one-line fix diff",
  "kernel_refs": [
    "sys/netgraph/bridge/ng_bridge.c:310",
    "sys/netgraph/bridge/ng_bridge.c:324"
  ],
  "poc_changes": "",
  "attempts": 0,
  "guest_uname": "",
  "runtime_sec": 0,
  "guest_dirty": 0,
  "build_cmd": "",
  "run_cmd": "",
  "code_hash": "",
  "notes": "Distinct from DF-0590 (serialization family) and DF-0591 (numLinks==1 mbuf leak): this is the constructor error path.",
  "recommended_fix": "kfree(priv->tab, M_NETGRAPH) before kfree(priv) in the ng_make_node_common failure branch.",
  "fix_status": "not_testable"
}