{
  "finding_id": "DF-4269",
  "status": "untested",
  "reproduced": 0,
  "impact": "none",
  "confidence": "certain",
  "verdict": "Source-certain memory leak. wb_attach() allocates sc->wb_ldata (if_wb.c:779-781, contigmalloc sizeof(struct wb_list_data)+8 = ~296KB page-aligned contiguous memory) but wb_detach() frees sc->wb_ldata_ptr (if_wb.c:856-859), a DIFFERENT softc field (if_wbreg.h:377-378) that is never assigned anywhere in the tree (grep-exhaustive: only the declaration and the free reference it). The guard if (sc->wb_ldata_ptr) is therefore always false and the block leaks on every detach, including all wb_attach error paths (they tail-call wb_detach at if_wb.c:827-829). Root-triggered (kldunload/device removal) resource-exhaustion vector on a hardware-gated driver. Not kernel-reproduced: the guest has no W89C840F NIC (env.txt).",
  "exploit_chain": "",
  "evidence": "if_wb.c:779 (alloc into wb_ldata) vs if_wb.c:856-858 (free of wb_ldata_ptr); if_wbreg.h:377-378 (distinct fields); tree-wide grep for wb_ldata_ptr yields only the declaration + the free; VERDICT.md",
  "kernel_refs": [
    "sys/dev/netif/wb/if_wb.c:779",
    "sys/dev/netif/wb/if_wb.c:782",
    "sys/dev/netif/wb/if_wb.c:827",
    "sys/dev/netif/wb/if_wb.c:856",
    "sys/dev/netif/wb/if_wbreg.h:377"
  ],
  "poc_changes": "No PoC (hardware-gated); analysis pack.",
  "attempts": 0,
  "guest_uname": "DragonFly dfbsd 6.5-DEVELOPMENT DragonFly 6.5-DEVELOPMENT #0: Thu Jul  2 02:54:00 UTC 2026  root@dfbsd:/usr/obj/usr/src/sys/X86_64_GENERIC x86_64",
  "runtime_sec": 0,
  "guest_dirty": 0,
  "build_cmd": "",
  "run_cmd": "",
  "code_hash": "",
  "notes": "nfe-family attach/detach asymmetry. 295,944 bytes (64*4096 + 64*16 + 128*256 + 8) leaked per attach/detach cycle.",
  "recommended_fix": "Free sc->wb_ldata (the field that holds the contigmalloc result) in wb_detach.",
  "fix_status": "not_testable",
  "fix_baseline_reproduced": 0,
  "fix_patched_reproduced": 0,
  "fix_verdict": "Fix validation requires the NIC; the guest has none.",
  "fix_evidence": "fix.diff; VERDICT.md"
}