# DF-4234 VERDICT — attach error-path swdesc leak

**Verdict: source-certain Low memory leak on a hardware-gated error path;
untested (no PoC — Low severity, hardware precondition).**

## Trace

```
txp_attach()                    if_txp.c:202
  :241   txp_chip_init()        ok
  :248   txp_download_fw()      ok
  :255   sc->sc_ldata = contigmalloc(...)         ok
  :258   txp_alloc_rings(sc)
           :948-956  for (i = 0; i < RXBUF_ENTRIES; i++)
                       sc->sc_rxbufs[i].rb_sd = kmalloc(sizeof(struct txp_swdesc),
                                                        M_DEVBUF, M_WAITOK);
                     // pointers stored ONLY inside sc_ldata
           :972-991  ... READ_REG(TXP_A2H_0) != STAT_WAITING_FOR_BOOT /
                       != STAT_RUNNING  →  return(ENXIO)
  :259   error = ENXIO; goto fail;
fail:
  :327   txp_release_resources(dev);
           :370-371  contigfree(sc->sc_ldata, ...)   // rb_sd pointers die here
           // the 256 kmalloc'd swdescs are leaked (256 * 16 = 4096 bytes)
```

`txp_detach()` frees them (`if_txp.c:349-350`) but is only reached for
successfully-attached devices. `device_is_attached()` gating elsewhere
confirms attach-failure never routes through detach.

Fix in fix.diff: free `rb_sd` in `txp_release_resources()` under a
`sc_rxbufs != NULL` guard (it points into `sc_ldata`, so check before the
contigfree), plus `ifmedia_removeall()` for the post-`ifmedia_init` failure
path at `:315-322` (mirroring `txp_detach():346`).

Not runtime-verifiable: requires a 3c990 that passes chip-init + fw download
but fails the boot-record handshake (run.log: no such device on the guest).
Severity Low: no unprivileged trigger, bounded leak per event.

## Fix status (batch validation)
Applied with the 36 sibling fix.diffs of this batch in findings/poc/_batch41/all_fixes.patch; single in-guest `make -j6 nativekernel KERNCONF=X86_64_GENERIC` completed RC=0 with zero errors under -Werror (full log: findings/poc/_batch41/fix_build8.log). Behavior A/B intentionally skipped for this Info-tier item.