{
  "finding_id": "DF-5361",
  "title": "CISTPL_END MFC reset frees the pf structs but leaks every cfe on their chains (per-insertion kernel heap leak; unbounded with DF-5362)",
  "verdict": "reproduced",
  "reproduced": true,
  "impact": "leak",
  "method": "verbatim-rig: production parser sed-extracted byte-identical from guest /usr/src (sha256-gated), driven via pccard_read_cis() with crafted CIS on guard/canary buffers",
  "reproduce": {
    "build": "sh extract.sh . && cc -O2 -Wall -o rig rig_main.c",
    "run": "./rig mfcleak benign",
    "expected": "BASELINE: mfcleak card (CONFIG+CFTABLE+CFTABLE+MFC+NO_LINK+END, then a clean MFC chain) parses to normal termination with LEDGER 'alloc cfe=2 pf=1 | kfree cfe=0 pf=1 | LIVE cfe=2' -- 2 x 160-byte pccard_config_entry blocks orphaned by the reset at :638-644. The benign VALID 2-function MFC card also leaks its single pre-MFC cfe (LIVE cfe=3 of which 1 orphaned) -- the leak fires on well-formed cards, not only crafted ones. WITH fix.diff (f5361): LIVE cfe=0 and benign LIVE cfe=2 (only the entries belonging to the two live functions, freed by the correct teardown); everything else unchanged."
  },
  "kernel_refs": [
    "sys/bus/pccard/pccard_cis.c:635",
    "sys/bus/pccard/pccard_cis.c:638",
    "sys/bus/pccard/pccard_cis.c:641",
    "sys/bus/pccard/pccard_cis.c:644",
    "sys/bus/pccard/pccard_cis.c:908",
    "sys/bus/pccard/pccard_cis.c:909",
    "sys/bus/pccard/pccard_cis.c:916",
    "sys/bus/pccard/pccard.c:195",
    "sys/bus/pccard/pccard.c:317"
  ],
  "artifacts": [
    "README.md",
    "VERDICT.md",
    "extract.sh",
    "rig_shims.h",
    "rig_main.c",
    "run_matrix.sh",
    "build.sh",
    "run.sh",
    "build.log",
    "run.log",
    "fixed_run.log",
    "baseline_run.log",
    "matrix.log",
    "fix.diff",
    "extract_manifest.txt",
    "postboot_extract_manifest.txt",
    "postboot_run.log",
    "env.txt",
    "kernel_apply.log",
    "kernel_build.tail.log",
    "verdict.json",
    "manifest.json"
  ]
}