sorecvtcp(): MSG_OOB + sio path is missing 'm = m_free(m)' — repeated sbappend of the same mbuf corrupts the caller's sockbuf (latent, currently unreachable)

Summary

In sorecvtcp()'s MSG_OOB handler with a non-NULL sio (in-kernel receive-into-mbuf callers), the loop appends m and decrements resid but omits the m = m_free(m); that the identical branch in generic soreceive() has. Consequences if ever reached: the same mbuf chain is appended into sio repeatedly (sb_cc over-accounting, self-referential m_next chains → later m_freem walk never terminates) and an m_len==0 OOB reply spins the loop forever with no locks held. Currently unreachable: every sio!=NULL caller (nfs, ipfw3_sync, wg, smb, ng_ksocket) never passes MSG_OOB, and userland cannot supply sio.

Recommended fix

--- a/sys/kern/uipc_socket.c
+++ b/sys/kern/uipc_socket.c
@@ -1649,6 +1649,7 @@ sorecvtcp(struct socket *so, struct sockaddr **psa, struct uio *uio,
                sbappend(sio, m);
                KKASSERT(resid >= (size_t)m->m_len);
                resid -= (size_t)m->m_len;
+               m = m_free(m);
            } while (resid > 0 && m);

Timeline

• 2026-08-30 Discovered during pass-2 audit of uipc_socket.c (GLM 5.3).