# VERDICT — DF-4269 (contigmalloc leak: wb_ldata vs wb_ldata_ptr)

**Status: untested** — no W89C840F hardware in the guest (env.txt). The leak
is source-certain (grep-exhaustive): `wb_ldata_ptr` occurs exactly twice in
the whole tree — the declaration (if_wbreg.h:377) and the detach free
(if_wb.c:856-858) — and is never set, so `if (sc->wb_ldata_ptr)` is always
false and the `contigmalloc(sizeof(struct wb_list_data) + 8)` from attach
(if_wb.c:779-780) is never returned.

## Impact

- ~296KB (64*4096 + 64*16 + 128*256 + 8 = 295,944 bytes) of page-aligned,
  physically-contiguous kernel memory leaked per attach/detach cycle.
- Reachable by root via kldload/kldunload of if_wb.ko on any machine (the
  module builds and loads without the NIC; probe fails but attach already
  allocated? — no: on probe failure attach never runs, so the leak strictly
  requires the hardware to attach, or an attach-time failure after :779
  (mii_phy_probe failure, bus_setup_intr failure), which also tail-calls
  wb_detach and leaks.
- Severity Low: privileged unload + hardware presence; pure resource leak,
  no corruption.

## Fix

Free `sc->wb_ldata` (fix.diff). The `+8` size matches the allocation.

## Fix status (batch validation)
Applied with the 36 sibling fix.diffs of this batch in findings/poc/_batch41/all_fixes.patch; single in-guest `make -j6 nativekernel KERNCONF=X86_64_GENERIC` completed RC=0 with zero errors under -Werror (full log: findings/poc/_batch41/fix_build8.log). Behavior A/B intentionally skipped for this Info-tier item.