# DF-4659 — sc_ifbuf leaked on every down/up cycle

**File:** sys/dev/netif/plip/if_plip.c:332-333 (UP transition), :306-314 (DOWN
transition frees nothing), :336-341 (BUS_SETUP_INTR failure path also overwrites)
**Class:** CWE-401 memory leak — Low severity (root-gated ioctl), certain
**Verdict:** REPRODUCED (kernel heap leak)

## Repro (guest, run.log)
root, mtu 65535: vmstat -m devbuf BEFORE (1.34M / 236 allocs) ->
20 x (ifconfig lp0 down; ifconfig lp0 up) -> AFTER 2.67M / 256 allocs:
**+1.33MB / +20 allocations = one leaked mtu+14 (65549B) buffer per
cycle**, exactly 20 x 65549 = 1.31MB.

Cause: the UP branch allocates sc_ifbuf unconditionally without freeing
the previous allocation (down path never frees it; the buffer is only
freed by SIOCSIFMTU). Repeatable without bound -> kernel memory
exhaustion. (SIOCSIFMTU itself is properly paired.)

Fix: free any existing sc_ifbuf before the kmalloc at :332 (and on the
BUS_SETUP_INTR failure path at :336-341).

## Fix status (batch validation)
Applied with the 36 sibling fix.diffs of this batch in findings/poc/_batch41/all_fixes.patch; single in-guest `make -j6 nativekernel KERNCONF=X86_64_GENERIC` completed RC=0 with zero errors under -Werror (full log: findings/poc/_batch41/fix_build8.log). Behavior A/B intentionally skipped for this Info-tier item.

(No fix.diff for this item: documented recommendation only - see Fix above.)