nfsm_request_bio early-abort path leaks the kmalloc'd struct nfsm_info and never runs the done() callback

Summary

When nfs_request() fails in SETUP/AUTH (forced-unmount EIO, or KERB auth error), nfsm_request_bio() takes its early-abort path: it completes the caller's bio directly with biodone(info->bio) but the struct nfsm_info the caller kmalloc'd is designed to be freed only by the info->done callback, which is never invoked on this path — ~120 bytes of M_NFSREQ kernel heap leak per aborted async RPC. Distinct from DF-3043 (which tracks nm_bioqlen accounting on the same abort path). Triggers are privileged or unusual: a forced unmount (MNTK_UNMOUNTF) racing pending async bios, or KERB4 auth failure (dead config). An admin performing repeated forced unmounts under I/O load bleeds M_NFSREQ memory; no unprivileged or remote trigger. Fix: set info->error and call info->done(info) in the abort branch (row diff).

Timeline

• 2026-09-02 Discovered during pass-2 audit of nfsm_subs.c (GLM 5.3). The engine core (dissect cross-mbuf advance, mbuftobio clamp, reply self-extend, uiombuf bounds, pad-write algebra) proven safe with exact citations.