# DF-4269 — wb_attach() allocates sc->wb_ldata but wb_detach() frees sc->wb_ldata_ptr (never assigned)

Files: `sys/dev/netif/wb/if_wb.c:779-786` (attach), `:852-859` (detach),
`sys/dev/netif/wb/if_wbreg.h:377-378` (two distinct softc fields).

## What

```c
sc->wb_ldata = contigmalloc(sizeof(struct wb_list_data) + 8, M_DEVBUF,   /* :779 */
    M_WAITOK | M_ZERO, 0, 0xffffffff, PAGE_SIZE, 0);
...
if (sc->wb_ldata_ptr) {                                                  /* :856 */
        contigfree(sc->wb_ldata_ptr, sizeof(struct wb_list_data) + 8,    /* :857 */
            M_DEVBUF);
}
```

`wb_ldata_ptr` (caddr_t, if_wbreg.h:377) is never assigned anywhere in the
tree (verified: only occurrences are the declaration and the detach free).
The allocation lives in `sc->wb_ldata` (if_wbreg.h:378). Every wb_detach()
therefore frees NULL and **leaks the contigmalloc block**: ~296KB
(sizeof(struct wb_list_data) + 8 = 64×4096 + 64×16 + 128×256 + 8) of
physically-contiguous, page-aligned kernel memory per attach/detach cycle —
including every `wb_attach()` error path (they tail-call wb_detach, :827-829).

## Impact

Unbounded kernel memory leak on module unload (`kldunload if_wb.ko`) /
device removal / failed attach; repeat cycles exhaust kernel memory and
contiguous pages. Privileged trigger, hardware-gated driver.