DF-5830 — FIX VALIDATION (fix.diff: kern_sendmsg() frees the control mbuf on
its holdsock() early return, matching sosend()'s all-paths consumption
contract).

Kernel build (inside guest /usr/src, clean-source snapshot + fix.diff):
  root# cd /usr/src && patch -p1 -s < /tmp/fix.diff && echo PATCHED
  PATCHED
  root# grep -n "DF-5830" sys/kern/uipc_syscalls.c
  802:		 * DF-5830: Take ownership of the control mbuf on this
  root# cd /usr/src && make -j4 nativekernel KERNCONF=X86_64_GENERIC
  ... (367.02 real / 1153.73 user / 243.26 sys; completes clean)
  >>> Kernel build for X86_64_GENERIC completed on Tue Oct 13 09:49:04 UTC 2026
  root# make installkernel KERNCONF=X86_64_GENERIC && shutdown -r now

  Rebooted into: DragonFly 6.5-DEVELOPMENT #1: Tue Oct 13 09:45:32 UTC 2026
  (vs stock #0: Thu Jul  2 06:02:54 UTC 2026)

PATCHED KERNEL — leak path (3 x 20000, exactly the baseline protocol):

  maxx$ /tmp/df5830_leak 20000
  OK: 20000 sendmsg calls on regular-file fd (all ENOTSOCK)
  root# netstat -m | sed -n 1p
  7/146632 mbufs in use (current/max):

  maxx$ /tmp/df5830_leak 20000
  OK: 20000 sendmsg calls on regular-file fd (all ENOTSOCK)
  root# netstat -m | sed -n 1p
  7/146632 mbufs in use (current/max):

  maxx$ /tmp/df5830_leak 20000
  OK: 20000 sendmsg calls on regular-file fd (all ENOTSOCK)
  root# netstat -m | sed -n 1p
  7/146632 mbufs in use (current/max):

  => LEAK ELIMINATED: 7 -> 7 -> 7 -> 7 (baseline stock kernel was
     7 -> 20007 -> 40007 -> 60007).

PATCHED KERNEL — happy-path regression (double-free check; control consumed by
a real AF_UNIX socketpair 20000 times):

  maxx$ /tmp/df5830_leak 20000 ok
  OK: 20000 sendmsg calls on AF_UNIX socketpair (control consumed)
  root# netstat -m | sed -n 1p
  7/146632 mbufs in use (current/max):
  => no panic, no double-free, no regression (sosend() still owns/consumes
     control on every path once holdsock() succeeds).

PATCHED KERNEL — control-copyin-failure regression (msg_control pointing at
unmapped memory; exercises the m_free(control)+goto cleanup path 50000 times):

  OK: 50000 EFAULT control-copyin failures, no panic
  8/146632 mbufs in use (current/max):
  => no double-free on the copyin-failure path either (+1 transient is the
     ssh exec's own socket, not cumulative over 50000 iterations).