DF-5322 baseline (UNPATCHED production sys/bus/firewire/firewire.c)
====================================================================
guest: DragonFly dfbsd 6.5-DEVELOPMENT #0 X86_64_GENERIC, 6 vCPUs, no
FireWire hardware.  Module df5322.ko compiles the unmodified production
firewire.c in (globals -D-renamed) and mode 0 drives exactly the
production split-transaction-timeout sequence:
fw_xfer_alloc -> fw_get_tlabel (inserts tlabel) ->
firewire_xfer_timeout (unlinks tlabel WITHOUT kfree at firewire.c:348,
completes the xfer) -> fw_xfer_free (owner-side; its fw_tl_free scan
cannot find the removed tlabel, so it is never kfree'd).
M_FW in-kernel allocation stats (ks_use[cpu].inuse/memuse, all CPUs
summed) are measured around the loop; zones prewarmed.

$ sh build.sh
$ sh run.sh
  (kldload /root/df5322/df5322.ko
   sysctl kern.df5321_mode=0 kern.df5321_iters=5000
   sysctl kern.df5321_fire=1)

root0: split transaction timeout dst=0x111 tl=0x8 state=3
DF5322: 5000 split-transaction timeouts
DF5322: M_FW inuse delta = 5000 objects, memuse delta = 80000 bytes (each leaked struct tlabel = 16 bytes)
DF5322: LEAK REPRODUCED: ~1 tlabel leaked per timeout (firewire.c:348 unlinks without kfree)

=> exactly one leaked 16-byte struct tlabel per timed-out transaction.
(identical result previously captured from the byte-identical df5321.ko
artifact during the DF-5321 series; this is the self-contained rerun
from a fresh `vm.sh reset with-src` boot.)