# DF-3803 — `mprsas_prepare_for_tm` leaks a CCB + path on every TM reuse/escalation

- File: `sys/dev/raid/mpr/mpr_sas.c`
- Class: unbounded kernel memory leak under error recovery
- Severity: Low / Confidence: certain (statically provable)
- Status on guest: not_reproduced — no SAS3 HBA (see `env.txt`)

## Defect

`mprsas_prepare_for_tm` (`mpr_sas.c:3787-3813`) allocates a fresh CCB and path
and assigns them unconditionally:

```c
	ccb = xpt_alloc_ccb();                        /* :3801 */
	if (ccb) {
		if (xpt_create_path(&ccb->ccb_h.path, ...) != CAM_REQ_CMP)
			xpt_free_ccb(&ccb->ccb_h);
		else {
			tm->cm_ccb = ccb;                 /* :3808 — overwrites, no free */
			...
		}
	}
```

`mprsas_free_tm` (`mpr_sas.c:243-270`) frees only the **last** `tm->cm_ccb`.

The error-recovery state machine calls `prepare_for_tm` multiple times on the
**same** `tm`:

1. `mprsas_send_abort` → prepare (`mpr_sas.c:1643`)
2. abort completes, more timed-out commands → `mprsas_send_abort` again
   (`mpr_sas.c:1584` → prepare at 1643) — **leaks ccb #1**
3. abort fails → LUN reset (`mpr_sas.c:1594` → `mpr_sas.c:1476`) — leaks again
4. LUN reset fails → target reset (`mpr_sas.c:1365` → `mpr_sas.c:1487`) — leaks again

Each leak is `sizeof(union ccb)` (several hundred bytes, includes a kmalloc'd
`timeout_ch`, `cam_xpt.c:4933-4935`) plus a `cam_path`. A target with N timed-out
commands under a failing device leaks N-1 CCBs; sustained error storms leak
without bound. Memory pressure on a storage box is a availability problem, not
a corruption problem → Low.

## Fix

Free the previous `tm->cm_ccb` (path + ccb) before overwriting — see `fix.diff`.

## Guest verification

No SAS3 controller in the guest → the SIM never runs; static proof only.
See `env.txt`.

## Fix status (batch validation)
Applied with the 36 sibling fix.diffs of this batch in findings/poc/_batch41/all_fixes.patch; single in-guest `make -j6 nativekernel KERNCONF=X86_64_GENERIC` completed RC=0 with zero errors under -Werror (full log: findings/poc/_batch41/fix_build8.log). Behavior A/B intentionally skipped for this Info-tier item.