DF-5830 — DECISIVE BASELINE RUN (stock kernel DragonFly 6.5-DEVELOPMENT #0, Jul 2 2026)
Run as unprivileged user "maxx" (uid 1000); netstat read as root.

CONTROL EXPERIMENT (real AF_UNIX socketpair — control mbuf is consumed by the
receiver; a leak here would mean the mbuf plumbing itself leaks):

  root# netstat -m | head -2                      [---CONTROL-BEFORE]
  7/146632 mbufs in use (current/max):
  256/33296 mbuf clusters in use (current/max):
  maxx$ /tmp/df5830/leaksendmsg 20000 ok
  OK: 20000 sendmsg calls on AF_UNIX socketpair (control consumed)
  root# netstat -m | head -2                      [---CONTROL-AFTER]
  7/146632 mbufs in use (current/max):
  256/33296 mbuf clusters in use (current/max):
  -> NO growth on the success path. Baseline is clean.

LEAK RUNS (regular-file fd => kern_sendmsg() early-returns ENOTSOCK at
uipc_syscalls.c:799-801 BEFORE any consumer takes the control mbuf; sys_sendmsg
never frees it => one permanently-leaked MT_CONTROL mbuf per call):

  maxx$ /tmp/df5830/leaksendmsg 20000
  OK: 20000 sendmsg calls on regular-file fd (all ENOTSOCK)
  root# netstat -m | sed -n 1p
  20007/146632 mbufs in use (current/max):

  maxx$ /tmp/df5830/leaksendmsg 20000
  OK: 20000 sendmsg calls on regular-file fd (all ENOTSOCK)
  root# netstat -m | sed -n 1p
  40007/146632 mbufs in use (current/max):

  maxx$ /tmp/df5830/leaksendmsg 20000
  OK: 20000 sendmsg calls on regular-file fd (all ENOTSOCK)
  root# netstat -m | sed -n 1p
  60007/146632 mbufs in use (current/max):

  => EXACTLY +20000 mbufs per 20000 failing sendmsg(2) calls; count never
     drops between runs (processes exited; nothing is ever reclaimed).
     Linear, permanent, unprivileged: 7 -> 20007 -> 40007 -> 60007.

Post-reset confirmation (guest force-reset to the clean-source snapshot and
rebooted fresh, then one round on the freshly booted stock kernel):

  root# netstat -m | sed -n 1p
  7/146632 mbufs in use (current/max):
  maxx$ /tmp/df5830_leak 20000
  OK: 20000 sendmsg calls on regular-file fd (all ENOTSOCK)
  root# netstat -m | sed -n 1p
  20007/146632 mbufs in use (current/max):
  -> reproduces from a fresh boot.  See run.2.log / VERDICT.md.