{"finding_id":"DF-4845","status":"untested","attempts":0,"reproduced":0,"impact":"leak","confidence":"certain","verdict":"Small privileged leak: le_pci_attach -> am79900_config -> lance_config calls ifmedia_init + ifmedia_add per medium (6 entries for PCnet-PCI, each kmallocing an ifmedia_entry), but neither the detach path (am79900_detach is a bare ether_ifdetach) nor the failed-attach unwind ever calls ifmedia_removeall - ~150-200 bytes leaked per attach/detach cycle (kldunload, devctl detach, or attach failure under the hostile-PCI model with driver retry on rescan). Identical pattern in pcn(4) - fix belongs family-wide. ifmedia_removeall-before-ether_ifdetach fix.","exploit_chain":"kldload/kldunload if_lnc cycles (or hostile NIC attach-fail + rescan retry) -> monotonic ifmedia_entry growth","evidence":"findings/poc/DF-4845/ (this verdict)","kernel_refs":["sys/dev/netif/lnc/if_lnc_pci.c:449","sys/dev/netif/lnc/if_lnc_pci.c:482","sys/dev/netif/lnc/lance.c:138-148","sys/dev/netif/lnc/am79900.c:173-177"],"guest_uname":"","code_hash":""}