# DF-4659 — sc_ifbuf leaked on every down/up cycle

**File:** sys/dev/netif/plip/if_plip.c:332-333 (UP transition), :306-314 (DOWN
transition frees nothing), :336-341 (BUS_SETUP_INTR failure path also overwrites)
**Class:** CWE-401 memory leak — Low severity (root-gated ioctl), certain
**Verdict:** REPRODUCED (kernel heap leak)

## Repro (guest, run.log)
root, mtu 65535: vmstat -m devbuf BEFORE (1.34M / 236 allocs) ->
20 x (ifconfig lp0 down; ifconfig lp0 up) -> AFTER 2.67M / 256 allocs:
**+1.33MB / +20 allocations = one leaked mtu+14 (65549B) buffer per
cycle**, exactly 20 x 65549 = 1.31MB.

Cause: the UP branch allocates sc_ifbuf unconditionally without freeing
the previous allocation (down path never frees it; the buffer is only
freed by SIOCSIFMTU). Repeatable without bound -> kernel memory
exhaustion. (SIOCSIFMTU itself is properly paired.)

Fix: free any existing sc_ifbuf before the kmalloc at :332 (and on the
BUS_SETUP_INTR failure path at :336-341).