Summary

rts_attach assigns so->so_pcb = rp and takes a pcb soreference BEFORE calling raw_attach. On raw_attach failure it kfrees the rawcb without clearing so->so_pcb and without dropping the pcb reference. socreate's error path then calls sofree(), which only decrements so_refs from 2 to 1 - the socket leaks permanently holding a dangling so_pcb; a later raw_detach on it would LIST_REMOVE freed memory (UAF). Identical missing-cleanup shape in raw_uattach. LATENT: raw_attach can fail solely at soreserve and DragonFly's chgsbsize clamps instead of failing (always returns 1), so the path is unreachable in the current tree - if soreserve ever regains a failure mode (rlimit enforcement restored as in FreeBSD), an unpriv user looping socket(AF_ROUTE,...) under a lowered RLIMIT_SBSIZE would leak one struct socket per attempt with a dangling pcb pointer. Hardening: fix the error path before it becomes reachable. No runnable PoC (trigger dead code). Fix: 'so->so_pcb = NULL; sofree(so);' before kfree in rts_attach's error path (raw_uattach same contract). [VERIFIED pass2: rts_attach frees rawcb without clearing so_pcb; latent soreserve cannot fail here; cleanup fix compiled]