m_extadd() lacks the M_EXT precondition guard m_mclget() has — calling it on a cluster mbuf yields m_sharecount()/m_free() type confusion and a wrong-cache objcache_put

Summary

m_extadd() blindly overwrites m_ext and ORs in M_EXT without asserting the mbuf has no external storage, unlike its sibling m_mclget() which KKASSERTs !(m->m_flags & M_EXT). If invoked on an mbuf that already carries an mbuf-cluster, M_EXT_CLUSTER stays set while ext_arg/ext_free become the caller's custom pair. Every subsequent consumer keys off those flags: m_sharecount() reads the custom ext_arg as struct mbcluster *->mcl_refs, and m_free()'s cluster case either objcache_put()s the mbuf — still pointing at the CUSTOM buffer with custom ext_free — into mbufphdr(j)cluster_cache, handing the next m_getjcl() consumer a foreign buffer with wrong lifetime, or leaks the original cluster's reference permanently (cluster-pool exhaustion). Zero in-tree callers (grep) — latent API hazard for in-kernel/out-of- tree module misuse.

Recommended fix

--- a/sys/kern/uipc_mbuf.c
+++ b/sys/kern/uipc_mbuf.c
@@ -1476,6 +1476,7 @@ void
 m_extadd(struct mbuf *m, void *buf, u_int size, void (*reff)(void *),
     void (*freef)(void *), void *arg)
 {
+   KKASSERT((m->m_flags & M_EXT) == 0);
    m->m_ext.ext_arg = arg;
    m->m_ext.ext_buf = buf;
    m->m_ext.ext_ref = reff;
@@ -1484,5 +1485,5 @@ m_extadd(struct mbuf *m, void *buf, u_int size, u_int size, void (*reff)(void *),
    m->m_ext.ext_size = size;
    reff(arg);
    m->m_data = buf;
-   m->m_flags |= M_EXT;
+   m->m_flags = (m->m_flags & ~(M_EXT_CLUSTER | M_CLCACHE)) | M_EXT;
 }

Timeline

• 2026-08-30 Discovered during pass-2 audit of uipc_mbuf.c (GLM 5.3).