socket_wait() leaks one file descriptor into the caller's fd table on every call (and on its error path)

Summary

socket_wait() does falloc+fsetfd (which publishes a new fd holding its own reference) but never closes/uninstalls it: on the kqueue_register error path it fdrop()s only the caller's reference (fd remains), and on the success path it swaps fp->f_ops to badfileops and fdrop()s — the fd stays permanently installed in curproc's table, unknown to the caller. No UAF (fsetfd takes its own reference), purely an fd leak: each call permanently consumes one descriptor until process exit. Only in-tree caller is netproto/smb/smb_trantcp.c:226 (legacy bucket) — repeated SMB transactions exhaust the caller's fd limit.

Recommended fix

Track the reserved fd and uninstall it before returning (funsetfd on the error path; pass the fd back or close it on completion).

Timeline

• 2026-08-30 Discovered during pass-2 audit of sys_generic.c (GLM 5.3).