Memory leak in netmap_open when devfs_set_cdevpriv fails — kfree missing on error path

Summary

netmap_freebsd.c:382 priv=kmalloc(sizeof(struct netmap_priv_d)). :387 error=devfs_set_cdevpriv(ap->a_fp,priv,netmap_dtor). :388-389 if(error) return error — priv NOT kfree before return. devfs_set_cdevpriv (devfs_core.c:2961-2986) returns ENOENT (NULL fp impossible normal open) or EBUSY (f_data1 already set not attacker-controllable fresh fd). sizeof(struct netmap_priv_d) leaked per failed open. No security impact: no kernel pointer deref of leaked memory underlying objects have own refcounts no cascade UAF. Hardening fix: kfree(priv) before return error.