# DF-5322 — verdict

**Status: reproduced (measured kernel memory leak, production path)**
**Impact: leak (unbounded, slow kernel memory exhaustion)**
**Confidence: certain**

Guest: DragonFly dfbsd 6.5-DEVELOPMENT #0 X86_64_GENERIC (6 vCPU, no
FireWire hardware).  Evidence class: KLD harness (DF-5230/DF-5302
pattern) compiling the unmodified production `firewire.c` into the
module; mode 0 drives exactly the production sequence of a
split-transaction timeout:

```
fw_xfer_alloc()                    /* the FW_ASYREQ/fwmem xfer        */
fw_get_tlabel()                    /* inserts the tlabel (M_FW)       */
firewire_xfer_timeout()            /* 10 Hz watchdog: unlinks the
                                       tlabel at firewire.c:348
                                       WITHOUT kfree, completes xfer  */
fw_xfer_free()                     /* owner-side free: fw_tl_free()
                                       scans the list, finds nothing,
                                       never kfrees the tlabel        */
```

The harness measures the renamed-but-identical `M_FW` malloc type
in-kernel (`ks_use[cpu].inuse/memuse`, summed over all CPUs) across
5000 iterations (zones prewarmed; no other `M_FW` activity).

## Result (baseline, unpatched production source)

```
DF5322: 5000 split-transaction timeouts
DF5322: M_FW inuse delta = 5000 objects, memuse delta = 80000 bytes
        (each leaked struct tlabel = 16 bytes)
DF5322: LEAK REPRODUCED: ~1 tlabel leaked per timeout
```

Exactly one leaked 16-byte `struct tlabel` per timed-out transaction —
matching the static analysis: the only `kfree` site is `fw_tl_free()`
(firewire.c:900) and it requires list membership, which
`firewire_xfer_timeout()` destroyed at firewire.c:348.

An independent confirmation is the panic in the sibling DF-5321 runs:
the watchdog dereferenced tlabels freed by *other* paths, proving these
objects' lifetime is not tracked anywhere after the timeout unlinks
them.

## Exploitability

Memory-exhaustion DoS only (16 bytes per timed-out transaction,
attacker-paced, `M_FW` unbounded).  No information disclosure, no
corruption from this defect alone.

## Fix validation

`fix.diff` (shared with DF-5321) adds `kfree(tl, M_FW)` for the
timeout-unlinked tlabel inside the new `fc->tlabel_lock` critical
region.  Applied to the guest `/usr/src`, module rebuilt, identical
trigger:

```
DF5322: 5000 split-transaction timeouts
DF5322: M_FW inuse delta = 0 objects, memuse delta = 0 bytes
```

**fix_status: fixed.**

## Bottom line

Certain, production-path, unbounded-but-slow kernel memory leak,
reproduced and measured on the audit guest, fixed by a one-line kfree
(carried inside the DF-5321 serialization fix).

## Fix status (batch validation)
Applied with the 36 sibling fix.diffs of this batch in findings/poc/_batch41/all_fixes.patch; single in-guest `make -j6 nativekernel KERNCONF=X86_64_GENERIC` completed RC=0 with zero errors under -Werror (full log: findings/poc/_batch41/fix_build8.log). Behavior A/B intentionally skipped for this Info-tier item.