# DF-3551 evidence pack — v1 ng_sample debug-hook mbuf leak (DF-0690 twin)

`sys/netgraph/ng_sample.c`: on the debug hook (`hook->private == NULL`,
set in `ng_xxx_newhook` at :238-242), `ng_xxx_rcvdataq()`'s only free is
gated on `hook == xxxp->downstream_hook.hook` (:390-394) — a condition that
can never be true because the downstream hook always has private set
(:237). Every mbuf+meta pushed into `sample:debug` is leaked.

## Build / Run

Same `v1demo.c`, `build.sh`, module and graph setup as the DF-3550 pack
(one directory up). Decisive commands:

```
kldload ng_socket ; kldload /root/ngs1/ng_sample.ko
netstat -m                          # baseline
/root/v1demo leakctl 1200           # control: downstream, drained
netstat -m
/root/v1demo leakdbg 300            # +300 mbufs
netstat -m
/root/v1demo leakdbg 1200           # +1200 mbufs
netstat -m
```

## Expected

Exact, permanent, linear mbuf growth on the debug path (+N for N packets)
and zero growth on the drained downstream control path. See `run.log`
(taken from the same decisive session as DF-3550's).