# DF-4257 VERDICT — my(4) leaks my_ldata_ptr on detach and on failed attach

## Status: inconclusive on the audit guest (hardware-gated). Leak certain at source level.

## Reproduction attempt

`pciconf -l | grep 1516` on the audit guest: no Myson device (env.txt);
`my_probe` (if_my.c:754-771) never returns 0, so `my_attach` never runs and
neither the allocation nor the leak can occur. A purely software trigger
does not exist: the allocation is tied to PCI device attachment.

## Analysis

`grep -n "my_ldata_ptr" sys/dev/netif/my/if_my.c` yields exactly three
uses: the kmalloc (870), the alias assignment (872, 882), and the pointer
arithmetic — there is no `kfree(sc->my_ldata_ptr, M_DEVBUF)` anywhere in
the driver. `my_detach` (971-992) releases `my_irq` (987) and `my_res`
(989) only.

Two leak paths:

1. Normal lifecycle: attach succeeds → later `my_detach` (kldunload or
   device removal) frees everything except the 2,056-byte descriptor block.
   Repeatable by root without bound.
2. Failed attach: every `goto fail` after line 870 (no PHY found at
   936-939; `bus_setup_intr` failure at 955-961) dispatches to
   `my_detach(dev)` (966-968) which — because `device_is_attached()` is
   false — releases only the resources, leaking the block.

This is a distinct allocation from the mbuf leak in DF-1479 (which covers
`my_encap` failure inside `my_start`): DF-4257 is the softc-owned DMA
descriptor array.

Severity Low: kernel memory leak, 2 KB per event, root-driven unload or
hardware-provoked attach failure. CWE-401. Fix is a one-line kfree in
my_detach (fix.diff).

## Fix status (batch validation)
Applied with the 36 sibling fix.diffs of this batch in findings/poc/_batch41/all_fixes.patch; single in-guest `make -j6 nativekernel KERNCONF=X86_64_GENERIC` completed RC=0 with zero errors under -Werror (full log: findings/poc/_batch41/fix_build8.log). Behavior A/B intentionally skipped for this Info-tier item.