# DF-3532 - VERDICT

**status: inconclusive | reproduced: 0 | impact: none | confidence: likely**

Partially verified, honestly inconclusive on the measurement. The ng7 error branch is REACHABLE on the harness kernel: with a colliding node name pre-created, the failed open logs 'ttyNNN: node name exists?' (the ng7 ngt_open :212-216 branch) - captured in dmesg. The leak itself is code-certain: that branch does sc->flags |= FLG_DIE; NG_NODE_UNREF(sc->node); return(error) - ng7 ng_unref_node frees the node WITHOUT invoking nd_shutdown, and NG_NODE_SET_PRIVATE only runs at :221 AFTER naming succeeds, so the kmalloc'd ngt_softc (~140B, M_NETGRAPH) is orphaned per failed open. The quantitative demonstration was confounded by harness mechanics (ng7 naming-counter state across runs made collisions intermittent; pre-created nodes must be kept hooked to survive; a 500-cycle run produced 500 SUCCESSFUL opens with live-state growth, not leaks). Privileged-gated ~140B permanent leak per failed open stands on code.

## Kernel references
- sys/netgraph7/tty/ng_tty.c:212
- sys/netgraph7/tty/ng_tty.c:215
- sys/netgraph7/tty/ng_tty.c:221

## Evidence
run.log (dmesg 'tty500/tty501: node name exists?' + vmstat -m netgraph growth lines), ttyleak.c

## Recommended fix
free sc on the naming-failure path (kfree(sc, M_NETGRAPH) after the UNREF) or route through shutdown.

## Fix status (batch validation)
Applied with the 36 sibling fix.diffs of this batch in findings/poc/_batch41/all_fixes.patch; single in-guest `make -j6 nativekernel KERNCONF=X86_64_GENERIC` completed RC=0 with zero errors under -Werror (full log: findings/poc/_batch41/fix_build8.log). Behavior A/B intentionally skipped for this Info-tier item.