DF-4269 — wb_attach() allocates sc->wb_ldata but wb_detach() frees sc->wb_ldata_ptr (never assigned)

Files: sys/dev/netif/wb/if_wb.c:779-786 (attach), :852-859 (detach), sys/dev/netif/wb/if_wbreg.h:377-378 (two distinct softc fields).

What

sc->wb_ldata = contigmalloc(sizeof(struct wb_list_data) + 8, M_DEVBUF,   /* :779 */
    M_WAITOK | M_ZERO, 0, 0xffffffff, PAGE_SIZE, 0);
...
if (sc->wb_ldata_ptr) {                                                  /* :856 */
        contigfree(sc->wb_ldata_ptr, sizeof(struct wb_list_data) + 8,    /* :857 */
            M_DEVBUF);
}

wb_ldata_ptr (caddr_t, if_wbreg.h:377) is never assigned anywhere in the tree (verified: only occurrences are the declaration and the detach free). The allocation lives in sc->wb_ldata (if_wbreg.h:378). Every wb_detach() therefore frees NULL and leaks the contigmalloc block: ~296KB (sizeof(struct wb_list_data) + 8 = 64×4096 + 64×16 + 128×256 + 8) of physically-contiguous, page-aligned kernel memory per attach/detach cycle — including every wb_attach() error path (they tail-call wb_detach, :827-829).

Impact

Unbounded kernel memory leak on module unload (kldunload if_wb.ko) / device removal / failed attach; repeat cycles exhaust kernel memory and contiguous pages. Privileged trigger, hardware-gated driver.

VERDICT — DF-4269 (contigmalloc leak: wb_ldata vs wb_ldata_ptr)

Status: untested — no W89C840F hardware in the guest (env.txt). The leak is source-certain (grep-exhaustive): wb_ldata_ptr occurs exactly twice in the whole tree — the declaration (if_wbreg.h:377) and the detach free (if_wb.c:856-858) — and is never set, so if (sc->wb_ldata_ptr) is always false and the contigmalloc(sizeof(struct wb_list_data) + 8) from attach (if_wb.c:779-780) is never returned.

Impact

• ~296KB (644096 + 6416 + 128*256 + 8 = 295,944 bytes) of page-aligned, physically-contiguous kernel memory leaked per attach/detach cycle.
• Reachable by root via kldload/kldunload of if_wb.ko on any machine (the module builds and loads without the NIC; probe fails but attach already allocated? — no: on probe failure attach never runs, so the leak strictly requires the hardware to attach, or an attach-time failure after :779 (mii_phy_probe failure, bus_setup_intr failure), which also tail-calls wb_detach and leaks.
• Severity Low: privileged unload + hardware presence; pure resource leak, no corruption.

Fix

Free sc->wb_ldata (fix.diff). The +8 size matches the allocation.

Fix status (batch validation)

Applied with the 36 sibling fix.diffs of this batch in findings/poc/_batch41/all_fixes.patch; single in-guest make -j6 nativekernel KERNCONF=X86_64_GENERIC completed RC=0 with zero errors under -Werror (full log: findings/poc/_batch41/fix_build8.log). Behavior A/B intentionally skipped for this Info-tier item.