{
  "finding_id": "DF-4270",
  "status": "reproduced",
  "verdict": "Reproduced deterministically on production code: with the cluster pool drained (MGETHDR+MCLGET until MCLGET fails) so that the inlined wb_encap inside the REAL wb_start takes the :1255-1258 MCLGET-failure path on a 17-mbuf (>16-fragment, len 2176 > MHLEN) chain, the ignored return at if_wb.c:1327 leaves: (1) the dequeued packet chain leaked \u2014 mbtypes[MT_DATA] accounting (method self-tested) shows exactly +17 mbufs allocated and referenced by nothing (queue empty, chain[0].wb_mbuf NULL, wb_start freed nothing, chain links/markers intact), and the leak persists across the REAL wb_watchdog recovery; (2) the half-programmed descriptor ARMED for the NIC \u2014 frag[0] OWN-set (:1354), frags 1..15 OWN (:1232), LASTFRAG on 0/16 fragments, frag[15].wb_next one-past-the-array, and WB_TXSTART=0xFFFFFFFF written (:1355): the chip is started on an unterminated chain over stale next words; (3) TX completion wedged \u2014 the REAL wb_txeof.part.4 with a chip-completed head descriptor advances nothing (:1062 walk never enters), only the 5s watchdog recovers. Fix validated on the combined-fix kernel: wb_start mbuf delta -17 (chain freed), LEAK 0, fragments disarmed (0/16 OWN), TXSTART never issued, wb_tx_head NULL (no wedge), if_timer 0 \u2014 every defect marker gone, accounting closes exactly.",
  "reproduced": true,
  "impact": "dos",
  "confidence": "certain",
  "exploit_chain": "unprivileged local user shapes TX into >16-fragment chains (e.g. many small writes per packet) and applies ordinary cluster pressure (the systems own traffic suffices) -> per-failure leak of a full packet chain (leak spiral toward kernel memory exhaustion) + NIC started on an unterminated OWN-marked fragment chain + TX wedged until the 5s watchdog",
  "evidence": "run.kld.log (cluster pool exhausted after 34655 clusters, wb_start mbuf delta: 0, post-dispatch probe: MGETHDR ok; MCLGET FAILS, *** DF-4270 LEAK CONFIRMED: exactly the 17 mbufs ... ***, frags with OWN set: 16/16; frags with LASTFRAG set: 0/16, MMIO WB_TXSTART=0xffffffff, *** DF-4270 WEDGE CONFIRMED ***, after watchdog ... leaked mbufs STILL leaked: YES); run.kld_fixed.log (wb_start mbuf delta: -17, LEAK 0, frags with OWN set: 0/16, MMIO WB_TXSTART=0000000000, wb_tx_head == NULL ... FIXED behaviour); wb_start.disasm (failure paths faithful to source; m_freem(m_head) only on success)",
  "kernel_refs": [
    "sys/dev/netif/wb/if_wb.c:1327",
    "sys/dev/netif/wb/if_wb.c:1248",
    "sys/dev/netif/wb/if_wb.c:1251",
    "sys/dev/netif/wb/if_wb.c:1253",
    "sys/dev/netif/wb/if_wb.c:1255",
    "sys/dev/netif/wb/if_wb.c:1258",
    "sys/dev/netif/wb/if_wb.c:1283",
    "sys/dev/netif/wb/if_wb.c:1354",
    "sys/dev/netif/wb/if_wb.c:1355",
    "sys/dev/netif/wb/if_wb.c:1062",
    "sys/kern/uipc_mbuf.c:1249"
  ],
  "poc_changes": "Replaced the seeds no hardware -> analysis pack with a deterministic kernel-level reproduction: forced the exact MCLGET-failure precondition by draining mclmeta via MGETHDR+MCLGET (~34.6k clusters) inside the rig, enqueued the crafted 17-mbuf chain on the production classic ifq, dispatched the REAL wb_start, and observed leak (mbtypes accounting via nm-resolved statics), descriptor state, TXSTART MMIO, the REAL wb_txeof.part.4 wedge, and the REAL wb_watchdog path; added the fixed-kernel A/B. Rig incidents: first-run leak arithmetic under-counted by the chain-in-baseline (corrected; no kernel misbehaviour); unguarded txeof.part.4 dispatch panicked on the FIXED kernel after evidence capture (guard added mirroring wb_intrs caller-side NULL check, panic_rig_txeof_guard.txt).",
  "attempts": 4,
  "guest_uname": "DragonFly dfbsd 6.5-DEVELOPMENT DragonFly 6.5-DEVELOPMENT #0: Thu Jul  2 06:02:54 UTC 2026     root@dfbsd:/usr/obj/usr/src/sys/X86_64_GENERIC  x86_64 (baseline); #1: Wed Oct 14 22:35:12 UTC 2026 (fix validation)",
  "runtime_sec": 420,
  "guest_dirty": 0,
  "build_cmd": "cd /root/dfwb3 && make -m /usr/src/share/mk (KLD rig; kernel for fix validation: cd /usr/src && make -j6 nativekernel && make installkernel)",
  "run_cmd": "sh /root/dfwb3/kld_run.sh 4270   [fixed kernel: same command]",
  "code_hash": "7e63578586f10529a7038445604b887f9147dc6ffc90b61d38c334b13fb25194",
  "notes": "Leak quantified: exactly 17 mbufs per failure (chain-shaped), repeatable, surviving watchdog resets \u2014 the leak-spiral precondition is concrete. Impact class: memory-exhaustion DoS + NIC-facing unterminated DMA chain (on real hardware the chip walks stale wb_next words); no kernel memory corruption demonstrated (the leaked mbufs are referenced by nothing, not use-after-free). The >16-fragment shape is producible by unprivileged users via ordinary socket write patterns; cluster pressure occurs under normal system load (nmbclusters=33296 on the guest).",
  "recommended_fix": "Check wb_encap()s return in wb_start; on failure free the dequeued m_head, zero the partially programmed fragment statuses, restore wb_tx_free, and bail \u2014 validated as fix_validated.diff hunk 4 (the seeds fix, applied verbatim)",
  "fix_status": "fixed",
  "fix_baseline_reproduced": 1,
  "fix_patched_reproduced": 0,
  "fix_verdict": "fixed: on the patched kernel the failure path frees the chain (mbuf delta -17, LEAK 0), disarms all 16 fragment statuses, never writes TXSTART, leaves wb_tx_head NULL (no wedge), and if_timer 0; accounting closes exactly (baseline - 17 chain - 64 rx-ring)",
  "fix_evidence": "run.kld_fixed.log; fix_validated.diff; VERDICT.md Fix validation table"
}