# DF-5356 -- pccard_attach_card re-entry on card-detect bounce (leak + duplicate children)

**Impact:** unbounded kernel memory leak (376+ bytes per CD bounce cycle,
linear growth), zombie device tree with duplicate driver instances over
destroyed bridge windows, leaked I/O + CCR windows (which prime DF-5355's
busy-panic). Physical-access kmem-exhaustion DoS driven by an evil card
wiggling CD1#/CD2# every ~2 s.

## Reproduce (verbatim rig -- shared with DF-2318/DF-5355)

```
# on the DragonFly guest (pristine /usr/src):
sh build.sh            # machine-extracts production pccard.c/cis/subr_bus code
./rig2 reentry_leak    # the DF-5356 scenario (51 CD-bounce cycles)
./rig2 benign_cycle    # negative control (attach/detach, zero leak)
sh run_matrix.sh matrix
```

**Success criterion (baseline):**
```
[after attach #2 (bounce)]  ORPHANED: pf=1 cfe=1 (leak=376 bytes) | zombies=2
TOTAL after 51 bounce cycles: orphaned-kmalloc-blocks=102 leak=19176 bytes |
                              zombie-children=51 | io-held=28 ccr-held=28
```
**With the fix (fixed_run.log / postboot):** `TOTAL ... blocks=0 leak=0
zombies=0 io-held=0 ccr-held=0`, while `benign_cycle` still attaches 51 times.

The full rig lives in `../DF-2318/`; this pack is a self-contained copy.

## Fix

`fix.diff` (== `fixes/df5356.diff`): EBUSY guard at the top of
`pccard_attach_card` when `sc->card.pf_head` is non-empty (the removal path
empties the list at pccard.c:317-324, keeping the marker correct). The
originally-seeded hunk was malformed and was regenerated; validated by rig
A/B + combined-fix kernel boot. Never applied to sys/.