DF-3522 — ng_bridge constructor leaks priv->tab when ng_make_node_common fails

Status: untested (Low/Info-severity error-path leak; no PoC per the audit contract's skip rule for Info findings). Confidence: certain (code).

sys/netgraph/bridge/ng_bridge.c, constructor:

:310  priv->tab = kmalloc(MIN_BUCKETS * sizeof(*priv->tab), M_NETGRAPH,
:311                      M_NOWAIT | M_ZERO);
:312  if (priv->tab == NULL) {
:313          kfree(priv, M_NETGRAPH);
:314          return (ENOMEM);
:315  }
...
:324  if ((error = ng_make_node_common(&ng_bridge_typestruct, nodep))) {
:325          kfree(priv, M_NETGRAPH);      /* <-- priv->tab NOT freed */
:326          return (error);
:327  }

At :325 the successfully-allocated priv->tab (32 * sizeof(struct ng_bridge_bucket) = 256 bytes) is leaked. Reachability: the only non-ENOMEM failure of ng_make_node_common is "type not registered" (ng_base.c:386) — impossible for our own registered type — or its internal node kmalloc failure (M_NOWAIT), i.e. effectively KMALLOC-failure-only. Impact: negligible in practice (256 B under extreme memory pressure); filed for completeness since pass 1 missed it and the fix is one line:

--- a/sys/netgraph/bridge/ng_bridge.c
+++ b/sys/netgraph/bridge/ng_bridge.c
@@ -322,6 +322,7 @@
    /* Call superclass constructor */
    if ((error = ng_make_node_common(&ng_bridge_typestruct, nodep))) {
+       kfree(priv->tab, M_NETGRAPH);
        kfree(priv, M_NETGRAPH);
        return (error);
    }

Files

• VERDICT.md (this file) — no binary PoC (Info severity).

Fix status (batch validation)

Applied with the 36 sibling fix.diffs of this batch in findings/poc/_batch41/all_fixes.patch; single in-guest make -j6 nativekernel KERNCONF=X86_64_GENERIC completed RC=0 with zero errors under -Werror (full log: findings/poc/_batch41/fix_build8.log). Behavior A/B intentionally skipped for this Info-tier item.

(No fix.diff for this item: documented recommendation only - see Fix above.)