# DF-3541 — v1 ng_eiface: mbuf leak on every packet delivered to a DOWN interface (ng_eiface_rcvdata returns ENETDOWN without freeing)

## What

`ng_eiface_rcvdata()` (sys/netgraph/eiface/ng_eiface.c:514-515):

```c
	if ( !(ifp->if_flags & IFF_UP) )
		return (ENETDOWN);
```

v1 netgraph data-delivery convention is that `rcvdata` **consumes** the
mbuf on every path (see ng_frame_relay.c:415-417 `bad: NG_FREE_DATA(m, meta)`;
v1 `ng_send_data` passes ownership and its callers NULL their pointers).
The ng7 twin frees explicitly here (`NG_FREE_M(m)` before the identical
ENETDOWN return, sys/netgraph7/eiface/ng_eiface.c), confirming the
omission is a defect, not a convention.

Every packet pushed into the `ether` hook while the ngethX interface is
administratively DOWN (the default state after node creation) leaks one
mbuf + one cluster (>MHLEN packets). Unbounded: 500 packets → exactly
+500 clusters (run.log); line-rate traffic to a down member of a
root-built graph exhausts the kernel mbuf map (`0 requests for memory
denied` starts climbing, network subsystem fails).

## Trigger privilege

ROOT ONLY (verified: uid 1001 → EPERM at v1 ngc_attach,
sys/netgraph/socket/ng_socket.c:172). The graph must be built by root;
traffic through it can come from any source. Severity Medium
(kernel memory exhaustion DoS; needs a configured netgraph path).

## Build / Run (in-guest, root)

Requires DF-3486's validated fix applied to ng_eiface.c first — on
stock kernels v1 eiface node creation panics before this bug is
reachable (that is DF-3486, already filed; this finding is the next
defect behind it).

    sh build.sh       # applies DF-3486 unblock, builds v1 ng_eiface.ko + trigger
    sh run.sh         # loads stock v1 core/socket + rebuilt eiface; runs leak test
    # DOWN (default): +500 clusters per 500 packets
    # control (ifconfig ngethX up mid-run): zero growth

## Fix

`fix.diff`: free the mbuf before returning ENETDOWN (matches the ng7
twin). Validated: same test on the fixed module → zero growth, ENETDOWN
semantics preserved.