Bugs detected by GCC analyzer

[Stephen Hemminger <stephen@networkplumber.org>]

[-- Attachment #1: Type: text/plain, Size: 613 bytes --]

GCC now has a built in code analyzer which is enabled with -fanalyzer.

Building DPDK with that produces lots of warnings.
Given the volume of data AI proved helpful in pulling real bugs out of the noise.
I put first round of them in bugzilla.

Summary:

About a quarter of the reports are valid: of 894 distinct warning rows
(708 unique sites, 1267 log lines), 246 are real, 631 are false
positives and 17 I could not settle. Of the real ones, 88 are in app/
(75 in unit tests), and a further group is harmless. The full list is
in analyzer-triage.md.

Sending results here so that anyone interested can pickup.

[-- Attachment #2: analyzer-bugs.md --]
[-- Type: text/markdown, Size: 31818 bytes --]

# Bug summaries from GCC 16 -fanalyzer run

Line numbers are for commit 2e2f0d720c. Found with `-Dc_args=-fanalyzer`, buildtype=release.
One entry per root cause. Component is a suggestion for the DPDK bugzilla field.
Confidence: "confirmed" = source re-read in a second pass; "single pass" = read once.
None of these were reproduced at runtime.

---

## lib

### 1. pipeline: table entry parser accepts actions not belonging to the table
Component: other | Severity: major | Confidence: confirmed

`rte_swx_ctl_pipeline_table_entry_read()` (lib/pipeline/rte_swx_ctl.c:3131) finds the
action with `action_find(ctl, tokens[1])`, which searches all pipeline actions. It does not
check that the action is one of the table's actions. `entry->action_data` is allocated
from `table->params.action_data_size` (:321), or left NULL when that is 0.
`table_entry_action_argument_read()` (:2896) then copies the arguments into it. An entry
line naming an action with more argument bytes than the table allows writes past the
buffer, or to NULL.

### 2. pdcp: rte_pktmbuf_prepend() result not checked
Component: other | Severity: major | Confidence: confirmed

lib/pdcp/pdcp_process.c:59, :146 and :167 call `rte_pktmbuf_prepend(mb, 8)` and write
through the result with `rte_memcpy()`. With less than 8 bytes of headroom the result is
NULL and the datapath crashes.

### 3. pipeline: pipeline_spec_free() does not free the spec
Component: other | Severity: normal | Confidence: confirmed

`pipeline_spec_parse()` allocates `s` with calloc (lib/pipeline/rte_swx_pipeline_spec.c:2893).
`pipeline_spec_free()` (:2193-2211) frees the members and ends with
`memset(s, 0, sizeof(*s))`; it never frees `s`. Both callers (:3494 and
rte_swx_pipeline.c:14675) rely on it. The struct leaks on every parse.

### 4. pdump: BPF filter leaked on error in set_pdump_rxtx_cbs()
Component: other | Severity: normal | Confidence: confirmed

lib/pdump/rte_pdump.c:403 loads `filter = rte_bpf_load(p->prm)`. The later error returns
(invalid device name, port/queue checks, around :422-:453) return without
`rte_bpf_destroy(filter)`. A request with a filter and an invalid port leaks the program
each time.

### 5. node: kernel_rx_node_init() leaks recv_info when socket() fails
Component: other | Severity: minor | Confidence: confirmed

lib/node/kernel_rx.c:214 allocates `recv_info`; :222-224 returns when
`socket(AF_INET, SOCK_RAW, IPPROTO_RAW)` fails without freeing it.

### 6. eventdev: rxa_sw_vector_limits() does not set log2_sz
Component: eventdev | Severity: minor | Confidence: confirmed

lib/eventdev/rte_event_eth_rx_adapter.c:2961 fills min_sz, max_sz and the two timeouts but
not `log2_sz`. `rte_event_eth_rx_adapter_vector_limits_get()` returns the caller's
uninitialised value for the SW adapter, and the trace point at :3136 reads it.

### 7. graph: cluster_add() loses the array when realloc fails
Component: other | Severity: minor | Confidence: single pass

lib/graph/graph_stats.c:354 does `cluster->graphs = realloc(cluster->graphs, sz)`. On
failure the old block is leaked and the pointer is NULL.

### 8. eal: rte_dev_probe() rollback can call local_dev_remove(NULL)
Component: core | Severity: minor | Confidence: single pass

`local_dev_probe()` sets `*new_dev = NULL` (lib/eal/common/eal_common_dev.c:186) and can
return at :252 without setting it. `rte_dev_probe()` continues on `-EEXIST` (:321); if the
secondary sync then fails it reaches `rollback:` and calls `local_dev_remove(dev)` (:369)
with `dev == NULL`, which dereferences it (:405). Narrow path.

### 9. compressdev: rte_compressdev_capability_get() assumes capabilities is set
Component: other | Severity: minor | Confidence: single pass

`rte_compressdev_info_get()` zeroes `dev_info` and returns early when the PMD has no
`dev_infos_get` (lib/compressdev/rte_compressdev.c:685). `rte_compressdev_capability_get()`
(:59) then dereferences `dev_info.capabilities`. No in-tree PMD triggers it.

---

## drivers/net/bnxt

### 10. net/bnxt: double free in tfc_msg error path
Component: ethdev | Severity: major | Confidence: confirmed

`tfc_msg_alloc_dma_buf()` (drivers/net/bnxt/tf_core/v3/tfc_msg.c:151) frees `buf->va_addr`
at :160 when `rte_mem_virt2iova()` fails and leaves the pointer set. Every caller then goes
to `cleanup:` and calls `tfc_msg_free_dma_buf()` (:176), freeing it again. Callers:
`tfc_msg_idx_tbl_alloc_set`, `tfc_msg_idx_tbl_set`, `tfc_msg_idx_tbl_get`,
`tfc_msg_tcam_alloc_set`, `tfc_msg_tcam_set`.

### 11. net/bnxt: tfc_msg_idx_tbl_set() allocates the DMA buffer twice
Component: ethdev | Severity: normal | Confidence: confirmed

drivers/net/bnxt/tf_core/v3/tfc_msg.c:647 calls `tfc_msg_alloc_dma_buf(&buf, data_size)`
unconditionally, and :653 calls it again inside `if (req.data_size >= sizeof(req.dev_data))`.
The first buffer is overwritten and leaked on every DMA-sized set.

### 12. net/bnxt: uninitialised rxcmp1 used in compressed CQE SSE Rx
Component: ethdev | Severity: major | Confidence: confirmed

`crx_burst_vec_sse()` declares `__m128i rxcmp1[]` at
drivers/net/bnxt/bnxt_rxtx_vec_sse.c:448 and passes it to `crx_descs_to_mbufs()` (:498)
without ever writing it. `GET_DESC_FIELDS` (:51) blends `rxcmp1` into the `vlan_tci` word
of `rx_descriptor_fields1`, so every mbuf on this path gets stack garbage in `vlan_tci`.

### 13. net/bnxt: leaks in bnxt_alloc_ctx_mem_blk() error paths
Component: ethdev | Severity: minor | Confidence: single pass

drivers/net/bnxt/bnxt_ethdev.c: `ctx_pg_arr` (:5043) leaks when the `ctx_dma_arr`
allocation fails (:5050), and `ctx_dma_arr` leaks when `rte_memzone_reserve` fails (:5096).
`bnxt_free_ctx_mem()` does not recover them because `BNXT_CTX_FLAG_INITED` is not set.

### 14. net/bnxt: NULL check after dereference in bnxt_free_ctx_mem()
Component: ethdev | Severity: trivial | Confidence: confirmed

drivers/net/bnxt/bnxt_ethdev.c:5194-5196 dereferences `bp->ctx->tqm_mem[i]` twice and then
tests it for NULL. The check is dead or the dereference is wrong.

---

## drivers/net/intel

### 15. net/cpfl: cfgq leaked in vcpf_save_chunk_in_cfgq()
Component: ethdev | Severity: minor | Confidence: single pass

drivers/net/intel/cpfl/cpfl_ethdev.c:2201 allocates `cfgq`; :2210-2213 returns -ENOMEM
when the `cfgq_add` allocation fails without freeing it.

### 16. net/cpfl, net/idpf: adapter leaked on probe failure
Component: ethdev | Severity: minor | Confidence: single pass

`cpfl_pci_probe_first()` allocates `adapter` at drivers/net/intel/cpfl/cpfl_ethdev.c:3096
and returns at :3106 (devargs parse) and :3111 (adapter init) without freeing it.
`idpf_pci_probe()` has the same pattern: allocation at
drivers/net/intel/idpf/idpf_ethdev.c:1666, return at :1674.

### 17. net/cpfl: NULL dereference parsing a "parameter" content field without prog action
Component: ethdev | Severity: normal | Confidence: single pass

`cpfl_parse_content()` (drivers/net/intel/cpfl/cpfl_flow_parser.c:1989) reads
`prog->prog`, which is only set at :1881 when the mod rule key has a PROG action. The JSON
loader accepts a content field of type "parameter" for any key, so such a rule crashes
when used.

### 18. net/cpfl: cpfl_repr_create() returns uninitialised value
Component: ethdev | Severity: normal | Confidence: confirmed

`int ret;` (drivers/net/intel/cpfl/cpfl_representor.c:563) is only assigned inside the
allowlist loop. If the hash is empty or every entry is skipped by `if (dev != NULL)
continue;`, the function returns garbage at :662 and the callers may treat it as a probe
failure.

### 19. net/ice: kb leaked in _xlt_kb_get()
Component: ethdev | Severity: minor | Confidence: single pass

drivers/net/intel/ice/base/ice_xlt_kb.c:135 allocates `kb`; :144-148 returns NULL when
`ice_pkg_enum_section()` finds no section, without freeing it.

### 20. net/ice: DCF VF representor VLAN ops dereference NULL after DCF release
Component: ethdev | Severity: normal | Confidence: confirmed

`ice_dcf_vf_repr_hw()` returns NULL when `!repr->dcf_valid`
(drivers/net/intel/ice/ice_dcf_vf_representor.c:135). `ice_dcf_vlan_offload_ena()` (:233)
dereferences the result unchecked. Reached from the vlan_offload_set, vlan_pvid_set and
vlan_tpid_set ops.

### 21. net/idpf: unchecked allocation in idpf_vc_queue_grps_del()
Component: ethdev | Severity: minor | Confidence: single pass

drivers/net/intel/idpf/idpf_common_virtchnl.c:439 `rte_zmalloc()` result is dereferenced
at :441.

### 22. net/ixgbe: uninitialised buffers copied in E610 ACI commands
Component: ethdev | Severity: trivial | Confidence: single pass

`ixgbe_read_sr_word_aci()` passes uninitialised `data_local`
(drivers/net/intel/ixgbe/base/ixgbe_e610.c:3162) as a response buffer that
`ixgbe_aci_send_cmd_execute()` copies out at :240. `ixgbe_update_link_info()` passes an
unzeroed malloc that is copied at :395. Also `ixgbe_dev_mtu_set()`
(ixgbe_ethdev.c:5322) passes an uninitialised `dev_info` to `ixgbe_dev_info_get()`, which
does `dev_capa |=` on it (:3922). No functional effect seen.

---

## drivers/net/ntnic

### 23. net/ntnic: FPGA model constructors return unchecked malloc
Component: ethdev | Severity: minor | Confidence: single pass

`nthw_fpga_model_new`, `nthw_module_new`, `nthw_register_new`, `nthw_field_new`,
`nthw_param_new` (drivers/net/ntnic/nthw/model/nthw_fpga_model.c) return `malloc()`
directly and callers pass the result to `*_init()`, which dereferences it (:186, :245,
:296, :317, :418). Same in `nthw_id_table_create()`
(nthw/flow_api/flow_id_table.c:68, calloc dereferenced at :70).

### 24. net/ntnic: p_drv leaked on init failure
Component: ethdev | Severity: minor | Confidence: single pass

`nthw_pci_dev_init()` allocates `p_drv` at drivers/net/ntnic/ntnic_ethdev.c:2326 and
stores it with `store_pdrv()` (:2380). The later `return -1` paths (:2388, :2437, :2456,
...) do not free it or clear the stored pointer.

### 25. net/ntnic: NULL check after dereference in nthw_pci_dev_deinit()
Component: ethdev | Severity: trivial | Confidence: confirmed

drivers/net/ntnic/ntnic_ethdev.c:2680 dereferences `internals`; :2688 then loops on
`while (internals)`.

---

## drivers/net/nfp

### 26. net/nfp: double free on malformed firmware ELF
Component: ethdev | Severity: major | Confidence: confirmed

`nfp_elf_read_section_headers()` frees `ectx->shdrs_host_endian`, `shdrs_data` and `shdrs`
on its error labels (drivers/net/nfp/nfpcore/nfp_elf.c:866-870) without clearing them.
`nfp_elf_mutable_buf()` then goes to `elf_free:` and `nfp_elf_free()` (:275-277) frees the
same pointers again.

### 27. net/nfp: txq leaked on NFDK Tx queue setup failure
Component: ethdev | Severity: minor | Confidence: single pass

`nfp_net_nfdk_tx_queue_setup()` allocates `txq` at drivers/net/nfp/nfdk/nfp_nfdk_dp.c:460.
On memzone (:476) or txbufs (:499) failure it calls `nfp_net_tx_queue_release(dev,
queue_idx)`, which frees `dev->data->tx_queues[queue_idx]`. That slot is only assigned at
:513, so `txq` is not freed.

### 28. net/nfp: hw_priv/pf_dev leaked when firmware reports no ports in secondary
Component: ethdev | Severity: minor | Confidence: single pass

`nfp_pf_secondary_init()` (drivers/net/nfp/nfp_ethdev.c:2847): when
`nfp_net_get_phyports_from_fw()` returns 0, the port loop does not run and the function
returns 0 without attaching or freeing its allocations.

### 29. net/nfp: unchecked allocation in nfp_nsp_command_buf_dma_sg()
Component: ethdev | Severity: minor | Confidence: single pass

drivers/net/nfp/nfpcore/nfp_nsp.c:551 `rte_zmalloc()` result is dereferenced at :555.

### 30. net/nfp: rte_pktmbuf_prepend() not checked in NFD3 Tx metadata
Component: ethdev | Severity: normal | Confidence: confirmed

`nfp_net_nfd3_set_meta_data()` (drivers/net/nfp/nfd3/nfp_nfd3_dp.c:184) writes through
the result of `rte_pktmbuf_prepend(pkt, meta_data->length)` without a NULL check. A Tx
mbuf with VLAN or IPsec offload and too little headroom crashes.

---

## drivers/net/cnxk

### 31. net/cnxk: process_ack_message() overwrites the buffer pointer it just allocated
Component: ethdev | Severity: normal | Confidence: confirmed

drivers/net/cnxk/cnxk_rep_msg.c:338 sets `adata->u.data = rte_zmalloc(...)`. For
`msg_len == 8`, :341 does `rte_memcpy(&adata->u.data, buf, msg_len)`, overwriting the
pointer and leaking the allocation. For other sizes :343 copies into the unchecked
allocation.

### 32. net/cnxk: send_ack_message() never frees its buffer
Component: ethdev | Severity: normal | Confidence: confirmed

drivers/net/cnxk/cnxk_rep_msg.c:552 allocates `buffer` (CTRL_MSG_BUFFER_SZ). No path frees
it; the function ends at `done: return rc;` (:575).

### 33. net/cnxk: unchecked plt_zmalloc() in representor message and flow code
Component: ethdev | Severity: minor | Confidence: single pass

drivers/net/cnxk/cnxk_rep_msg.c:391, :419, :451, :613 and cnxk_rep_flow.c:213, :223 use
the `plt_zmalloc()` result without a NULL check. At cnxk_rep_msg.c:419 the new `adata`
also replaces the one stored at :394, which is leaked.

### 34. net/cnxk: flow leaked in cnxk_eswitch_pfvf_flow_rules_install()
Component: ethdev | Severity: minor | Confidence: single pass

drivers/net/cnxk/cnxk_eswitch_flow.c:395 allocates `flow`. The `goto free_flow` paths
(:403-429) call `cnxk_eswitch_flow_rules_remove_list()`, which only frees list members;
`flow` is not on the list yet.

### 35. net/cnxk: msg leaked in cnxk_representee_notification()
Component: ethdev | Severity: minor | Confidence: single pass

drivers/net/cnxk/cnxk_rep.c:398 allocates `msg`; when the `notify_msg` allocation fails
(:406-409) it jumps to `done` without freeing `msg`.

### 36. net/cnxk: TM node and shaper profile leaked when roc add fails
Component: ethdev | Severity: normal | Confidence: single pass

`cnxk_nix_tm_shaper_profile_add()` (drivers/net/cnxk/cnxk_tm.c:306-312) and
`cnxk_nix_tm_node_add()` (:394-399) return on a roc error without freeing the profile or
node they allocated. Reachable with invalid user parameters.

---

## drivers/net (others)

### 37. net/r8169: memset on NULL after failed append
Component: ethdev | Severity: normal | Confidence: confirmed

`rtl8125_ptp_patch()` (drivers/net/r8169/r8169_rxtx.c:1568-1571) logs when
`rte_pktmbuf_append()` returns NULL, then calls `memset(padding, 0, pad_len)` anyway.

### 38. net/zxdh: device-supplied length used for memcpy into 1-byte buffer
Component: ethdev | Severity: major | Confidence: confirmed

`zxdh_get_res_info()` (drivers/net/zxdh/zxdh_common.c:230) does `*len = tbl_reps->len;
rte_memcpy(res, ..., *len);`. Callers such as `zxdh_get_res_panel_id()` (:239) pass
`uint8_t reps`. A reply with len > 1 overruns the stack.

### 39. net/zxdh: flow leaked on validate
Component: ethdev | Severity: normal | Confidence: confirmed

`fd_flow_parse_pattern()` (drivers/net/zxdh/zxdh_flow.c:1256) and `fd_flow_parse_action()`
(:1664) allocate `flow` when `dh_flow == NULL` (the validate path). The success returns at
:1494 and :1831 do not free it; only the `free_flow:` error label does.

### 40. net/cxgbe: NULL mbuf dereferenced in set_tcb_field()
Component: ethdev | Severity: normal | Confidence: confirmed

drivers/net/cxgbe/cxgbe_filter.c:179 allocates an mbuf; `WARN_ON(!mbuf)` only logs and
:182 dereferences it.

### 41. net/cxgbe: pi->rss is never freed
Component: ethdev | Severity: minor | Confidence: single pass

`cxgbe_init_rss()` allocates `pi->rss` (drivers/net/cxgbe/cxgbe_main.c:688). There is no
`rte_free()` of that field in the driver (close or probe failure).

### 42. net/sfc: fields array leaked in sfc_tbl_meta_desc_read()
Component: ethdev | Severity: normal | Confidence: confirmed

drivers/net/sfc/sfc_tbl_meta_cache.c:137 allocates the temporary `fields` array. The
success path returns 0 at :163 without freeing it.

### 43. net/sfc: id leaked in sfc_hw_switch_id_init()
Component: ethdev | Severity: minor | Confidence: single pass

drivers/net/sfc/sfc.c:1435 allocates `id`; :1439-1441 returns when
`efx_nic_get_board_info()` fails without freeing it.

### 44. net/vmxnet3: queue structure leaked on setup failure
Component: ethdev | Severity: minor | Confidence: confirmed (Tx), single pass (Rx)

`vmxnet3_dev_tx_queue_setup()` allocates `txq` at drivers/net/vmxnet3/vmxnet3_rxtx.c:1047
and returns at :1070, :1074, :1098, :1122 without freeing it. `vmxnet3_dev_rx_queue_setup()`
does the same with `rxq` (:1151; returns at :1180, :1183, :1214, :1252).

### 45. net/xsc: bad IOVA handling in xsc_rxq_initialize()
Component: ethdev | Severity: normal | Confidence: confirmed

drivers/net/xsc/xsc_rx.c:231 allocates `jumbo_buffer_pa`. If `rte_malloc_virt2iova()`
returns RTE_BAD_IOVA (:240) the code continues without freeing it, and `jumbo_buffer_va`
keeps the bad value, so later iterations skip the allocation and use it as an address.

### 46. net/xsc: leak and unchecked allocation in init paths
Component: ethdev | Severity: minor | Confidence: single pass

`xsc_dev_init()` (drivers/net/xsc/xsc_dev.c:359) leaks `d` on `return -ENODEV` (:366).
`xsc_ethdev_tx_queue_setup()` (xsc_ethdev.c:546) dereferences the `rte_malloc_socket()`
result at :548 unchecked.

### 47. net/memif: leaks on error paths
Component: ethdev | Severity: minor | Confidence: confirmed (:1774), single pass (others)

drivers/net/memif/rte_eth_memif.c:
- `memif_mp_request_regions()`: `r` (:169) leaked at :176-179.
- `memif_region_init_zc()`: `r` (:1326) leaked at :1336.
- `memif_region_init_shm()`: `error:` (:1416) closes the fd but does not free `r`.
- `memif_tx_queue_setup()` / `memif_rx_queue_setup()`: `mq` (:1774, :1812) leaked when
  `rte_intr_instance_alloc()` or `rte_intr_type_set()` fails.

### 48. net/failsafe: rxq leaked when eventfd() fails
Component: ethdev | Severity: minor | Confidence: confirmed

`fs_rx_queue_setup()` allocates `rxq` at drivers/net/failsafe/failsafe_ops.c:461 and
returns at :478-481 when `eventfd()` fails, before the queue is stored.

### 49. net/gve: txq leaked on bad thresholds in DQO Tx queue setup
Component: ethdev | Severity: minor | Confidence: confirmed

drivers/net/gve/gve_tx_dqo.c:605 allocates `txq`; :618-619 returns -EINVAL from
`check_tx_thresh_dqo()` without going to the free label.

### 50. net/ionic: leak in ionic_qcq_alloc() CMB error path
Component: ethdev | Severity: minor | Confidence: single pass

drivers/net/ionic/ionic_lif.c (about :691): "Cannot reserve queue from NIC mem" returns
-ENOMEM directly instead of `goto err_out_free_info`, leaking `new`, `new->q.info` and the
memzone.

### 51. net/mana: priv leaked on secondary process probe
Component: ethdev | Severity: minor | Confidence: confirmed

`mana_probe_port()` allocates `priv` at drivers/net/mana/mana.c:2189. The secondary
process branch returns 0 at :2236 without freeing or storing it.

### 52. net/nbl: leaks on channel setup errors
Component: ethdev | Severity: minor | Confidence: confirmed (pipe), single pass (mailbox)

drivers/net/nbl/nbl_hw/nbl_channel.c: `nbl_chan_task_init()` (:596) does not close the
mailbox pipe fds when thread creation fails (:604-607). `nbl_chan_setup_chan_mgt()` (:943)
leaks `mailbox` when `nbl_chan_init_state_bitmap()` fails (:950).

### 53. net/ring: rings leaked on eth_dev_ring_create() failure
Component: ethdev | Severity: minor | Confidence: single pass

drivers/net/ring/rte_eth_ring.c:548, :556, :561 return -1 without freeing the rings
already created in `rxtx[]`.

### 54. net/softnic: msgq_req leaked when msgq_rsp creation fails
Component: ethdev | Severity: minor | Confidence: single pass

`softnic_thread_init()` (drivers/net/softnic/rte_eth_softnic_thread.c:69): the request
ring of the current iteration is not yet stored when `softnic_thread_free()` runs.

### 55. net/dpaa2: lsx_ccsr_map_region() result not checked
Component: ethdev | Severity: minor | Confidence: confirmed

drivers/net/dpaa2/dpaa2_recycle.c:406 and :469 read through `gur_base` without checking
for NULL. The helper returns NULL when /dev/mem cannot be opened or mapped (:186, :192).

### 56. net/ena: uninitialised metrics copied to xstats on admin failure
Component: ethdev | Severity: minor | Confidence: confirmed

`ena_xstats_get()` declares `metrics_stats[]` uninitialised
(drivers/net/ena/ena_ethdev.c:3677). `ena_copy_customer_metrics()` returns without filling
it on a count mismatch (:3454) or admin command failure (:3465). The loop at :3697 then
copies stack contents into the xstats values.

### 57. net/octeon_ep: rsp read after failed mbox send
Component: ethdev | Severity: minor | Confidence: single pass

`otx_ep_mbox_version_check()` (drivers/net/octeon_ep/otx_ep_mbox.c:343) reads
`rsp.s_version.version` when the send returned an error and `rsp` was not written. The
value ends up in `otx_ep->mbox_neg_ver`.

### 58. net: uninitialised values read without effect
Component: ethdev | Severity: trivial | Confidence: single pass

- drivers/net/mlx5/mlx5_rx.c:1252: `skip_cnt` not initialised in the out-of-order burst
  (the other two callers use `= 0`).
- drivers/net/cxgbe/cxgbe_ethdev.c:616: uninitialised `dev_info` passed to
  `cxgbe_dev_info_get()`, which does `dev_capa &=` (:133).
- drivers/net/hinic3/base/hinic3_nic_cfg.c:701: `port_stats` sent to firmware and logged
  with only `port_id` set.

---

## drivers/bus, common, crypto, compress, raw, baseband

### 59. bus/fslmc: double close of VFIO container fd
Component: other | Severity: normal | Confidence: confirmed

`fslmc_vfio_check_extensions()` closes `vfio_container_fd` on ioctl failure
(drivers/bus/fslmc/fslmc_vfio.c:483). The caller closes it again at :544.

### 60. bus/fslmc: ioctl on uninitialised fd in vfio_map_mcp_obj()
Component: other | Severity: normal | Confidence: confirmed

drivers/bus/fslmc/fslmc_vfio.c:1325 ignores the return of `fslmc_vfio_setup_device()`,
which can fail before writing `mc_fd`. :1328 then calls `ioctl(mc_fd, ...)`.

### 61. crypto/ccp: rte_pktmbuf_append() not checked
Component: cryptodev | Severity: major | Confidence: confirmed

`ccp_perform_aes_cmac()` (drivers/crypto/ccp/ccp_crypto.c:2034) appends
`session->auth.ctx_len` bytes and uses the result unchecked; :2120-2124 then write to
`append_ptr + CCP_SB_BYTES`. The appends at :1575, :1744 and :2375 are also unchecked.

### 62. crypto/ccp: memzone reserve result not checked in ccp_add_device()
Component: cryptodev | Severity: minor | Confidence: confirmed

drivers/crypto/ccp/ccp_dev.c:547 `ccp_queue_dma_zone_reserve()` can return NULL; :549-551
dereference `q_mz`.

### 63. crypto/cnxk: memcpy from NULL IV with unaligned offset and no IV
Component: cryptodev | Severity: normal | Confidence: confirmed

In `cpt_sm_prep()` (drivers/crypto/cnxk/cnxk_se.h:1213) `iv_len` is 0 when there is no IV,
so `src` stays NULL (:1259). The SG path passes `iv_len + pad_len` as the IV length
(:1265, :1269), and `sg_inst_prep()`/`sg2_inst_prep()` (:317, :556) memcpy that many bytes
from NULL when `pad_len` is non-zero (SM4-ECB, cipher offset not a multiple of 8).

### 64. crypto/mlx5: GCM qp setup error path releases an unassigned queue pair
Component: cryptodev | Severity: normal | Confidence: confirmed

`mlx5_crypto_gcm_qp_setup()` goes to `err:` and calls `mlx5_crypto_gcm_qp_release(dev,
qp_id)` (drivers/crypto/mlx5/mlx5_crypto_gcm.c:433). That function reads
`dev->data->queue_pairs[qp_id]` (:222), which is only assigned on success (:427). The new
`qp` leaks and the old slot (NULL or stale) is dereferenced.

### 65. crypto/caam_jr: unchecked allocation in init_job_ring()
Component: cryptodev | Severity: minor | Confidence: single pass

drivers/crypto/caam_jr/caam_jr.c:2197 and :2202 pass the `caam_jr_dma_mem_alloc()` result
to `memset()` unchecked (:2199, :2204).

### 66. crypto/cnxk: uninitialised index in tls13_trim_mac
Component: cryptodev | Severity: trivial | Confidence: single pass

drivers/crypto/cnxk/cn10k_cryptodev_ops.c:1041 and cn20k_cryptodev_ops.c:803 compute
`len_to_trim = mbuf->pkt_len - i` with `i` uninitialised when `res->rlen == 0`. The result
is unused in that case.

### 67. compress/octeontx: wrong mempool freed in zip_pmd_config()
Component: other | Severity: normal | Confidence: confirmed

drivers/compress/octeontx/otx_zip_pmd.c:255 calls `rte_mempool_free(vf->zip_mp)` when the
SG pool cannot be created. `vf->zip_mp` is not assigned until :258, so the new
`zip_buf_mp` leaks and a pool from an earlier configure may be freed while in use.

### 68. baseband/la12xx: resources leaked on IPC metadata size mismatch
Component: other | Severity: minor | Confidence: single pass

`setup_la12xx_dev()` (drivers/baseband/la12xx/bbdev_la12xx.c:891) returns
`IPC_MD_SZ_MISS_MATCH` directly, bypassing `err:`; allocations, fds and mappings leak.

### 69. bus/dpaa: fman leaked on _fman_init() failure
Component: other | Severity: minor | Confidence: single pass

drivers/bus/dpaa/base/fman/fman.c:60 allocates `fman`; the early returns (:68-:116) do not
free it or unmap.

### 70. common/qat: session leaked in qat_cq_get_fw_cipher_crc_cap()
Component: cryptodev | Severity: minor | Confidence: single pass

drivers/common/qat/qat_qp.c:844-846 returns -EINVAL without freeing `session`; :879-881
also leaks `src_data_addr`.

### 71. raw/cnxk_gpio: list leaked on invalid allowlist
Component: other | Severity: minor | Confidence: single pass

`cnxk_gpio_parse_allowlist()` (drivers/raw/cnxk_gpio/cnxk_gpio.c:254) allocates `list`;
:266-267 returns -EINVAL without freeing it.

### 72. raw/ifpga: leaks in altera_i2c_probe() and max10_parse_sensor_data()
Component: other | Severity: minor | Confidence: single pass

drivers/raw/ifpga/base/opae_i2c.c:472 `dev` leaked at :478 and :496.
drivers/raw/ifpga/base/opae_intel_max10.c:1358 `sensor` leaked by the `continue` at :1367
and the `break`s at :1378-:1399, all before it is inserted in the list (:1403).

### 73. raw/ifpga: feature address lookups not checked
Component: other | Severity: minor | Confidence: confirmed

`fpga_get_pr_uuid()` (drivers/raw/ifpga/base/ifpga_feature_dev.c:99) and
`port_clear_error()` (:197) read through the result of
`get_*_feature_ioaddr_by_index()` without a NULL check. The helper returns NULL when the
PR_MGMT or port ERROR feature is absent.

### 74. raw/ntb: leak and unchecked allocation in ntb_xstats_get_by_name()
Component: other | Severity: minor | Confidence: confirmed

drivers/raw/ntb/ntb.c:1240 allocates `xstats_names` without a NULL check (used at :1256);
:1270 returns -EINVAL for an unknown name without freeing it.

### 75. bus/platform: resource name leaked when mapping fails
Component: other | Severity: minor | Confidence: single pass

drivers/bus/platform/platform.c:299 stores the name in `pdev->resource[i].name`. If
`device_map_resource_offset()` fails (:301-304) the code jumps out before
`num_resource++`, so the cleanup loop (:178) does not free that name.

### 76. event/opdl: unchecked malloc in opdl_selftest()
Component: eventdev | Severity: trivial | Confidence: single pass

drivers/event/opdl/opdl_test.c:988 `malloc()` result used at :1027 without a check.

---

## app

### 77. app/test-compress-perf: double free of ops in cyclecount test
Component: other | Severity: normal | Confidence: confirmed

`cperf_cyclecount_op_setup()` frees `ops` at its `end:` label
(app/test-compress-perf/comp_perf_test_cyclecount.c:147). The caller `main_loop()` then
frees it again at :460.

### 78. app/test-regex: double free of rules, and uninitialised file names
Component: other | Severity: normal | Confidence: confirmed (double free), single pass (file names)

`read_file()` frees `*buf` on error (app/test-regex/main.c:222) and leaves it set;
`init_port()` frees `rules` again at :310. Separately, `rules_file` (:726) and `data_file`
are only written by their options and are passed to `fopen()` uninitialised if omitted.

### 79. app/proc-info: --collectd-format given twice closes stdout twice
Component: other | Severity: trivial | Confidence: confirmed

`proc_info_preparse_args()` (app/proc-info/main.c:394-396) does `dup(STDOUT_FILENO);
close(STDOUT_FILENO);` each time the option appears.

### 80. app/test-crypto-perf: NULL dereference in outbound IPsec ops setup
Component: other | Severity: minor | Confidence: single pass

`cperf_set_ops_security_ipsec()` (app/test-crypto-perf/cperf_ops.c:412) resets the source
mbuf, which sets `next = NULL`. If tailroom is below `digest_sz`, :425-429 does
`m = m->next; m->next = NULL;`. Depends on `--segment-sz`.

### 81. app/test-eventdev: src/dst never freed in dma_adapter_enq_op_fwd()
Component: other | Severity: minor | Confidence: single pass

app/test-eventdev/test_perf_common.c:592-593 allocate `src` and `dst`; they are only freed
on the allocation-failure branch.

### 82. app/graph: node_patterns and pcap_filename never freed
Component: other | Severity: trivial | Confidence: single pass

app/graph/l2fwd.c:34, :46 and app/graph/l3fwd.c:76, :90 allocate `node_patterns` and
`strdup()` the pcap file name. `rte_graph_create()` copies both; neither is freed.

### 83. app/test-dma-perf: unchecked malloc in parse_lcore()
Component: other | Severity: trivial | Confidence: single pass

app/test-dma-perf/main.c:190 `malloc()` result passed to `strlcpy()` at :191.

### 84. app/test-fib, app/test-flow-perf: allocations not freed
Component: other | Severity: trivial | Confidence: single pass

app/test-fib/main.c `run_v6()`: `lpm` (:1099) and `fib` (:1057) not freed on the error
return at :1131 or at the end (:1193). app/test-flow-perf/main.c:1865 `old` not freed.

### 85. test/cryptodev: mbuf allocations used without NULL check
Component: other | Severity: minor | Confidence: single pass (group judged from sampled sites)

app/test/test_cryptodev.c uses `rte_pktmbuf_alloc()` / `setup_test_string()` results
without a check at about 25 sites, e.g. :3626, :3719, :3808, :3899, :4126, :4588, :4682,
:5143, :5344, :5592, :6009, :6560, :6831, :6971, :9771, :17227, :19987, :20060, and via
`rte_pktmbuf_append()` at :2845, :4904, :4912, :9766. `create_segmented_mbuf()` NULL is
dereferenced in `pktmbuf_write()` (:6691). Also `sessions` (:14798), and
test_cryptodev_blockcipher.c:1344.

### 86. test: unchecked allocations in other unit tests
Component: other | Severity: trivial | Confidence: single pass

app/test/test_dmadev.c:308, test_dmadev_api.c:885, test_graph_perf.c:637,
test_thash_perf.c:96.

### 87. test: objects leaked when a test fails part way
Component: other | Severity: trivial | Confidence: single pass (group judged from sampled sites)

A failing assert or `return -1` skips the free in: test_bitmap.c:215; test_bitset.c:538-575
and `test_shift`; test_bpf.c:2148, :3962, :5155; test_event_eth_rx_adapter.c:922;
test_fib.c:557; test_fib6.c:585, :1179, :1275; test_fib6_perf.c:165; test_hash_perf.c:724;
test_lpm.c:1092, :1343, :1439; test_lpm6.c:157, :332, :370, :1530; test_malloc.c:256, :371,
:789; test_member.c:168; test_pdump.c:123; test_rcu_qsbr.c:928, :1092;
test_rcu_qsbr_perf.c:280, :380.

### 88. test: uninitialised stack data used in unit tests
Component: other | Severity: trivial | Confidence: single pass

- app/test/test_bitset.c:643-661: `bitset_a`/`bitset_b` declared but not initialised
  before `rte_bitset_assign()`.
- app/test/test_event_eth_tx_adapter.c:494: `rte_pktmbuf_reset()` on uninitialised stack
  mbufs.
- app/test/test_stack.c:524: `obj_table[]` pushed uninitialised.

---

## Not written up

Valid by the analyzer's definition but with no effect; listed in analyzer-triage.md section 5:
- `memcpy()` with a NULL pointer and length 0: drivers/crypto/cnxk/cnxk_ae.h:1242, :1381;
  drivers/crypto/caam_jr/caam_jr.c:1564-1613; drivers/net/nbl/nbl_hw/nbl_channel.c:737;
  drivers/net/netvsc/hn_rndis.c:593.
- lib/bpf/bpf_exec.c:487 (all five registers passed to an external function) and
  lib/telemetry/telemetry_json.h:45 (documented in the header).
- lib/eal/linux/eal_dev.c:207 (needs a duplicated uevent key).

[-- Attachment #3: analyzer-triage.md --]
[-- Type: text/markdown, Size: 12590 bytes --]

# GCC 16 -fanalyzer triage (analyzer.log, tree at 2e2f0d720c)

Build: buildtype=release, -O3, RTE_ASSERT compiled out.
1267 warnings in the log = 708 unique sites = 894 site+caller rows.

| Verdict | Rows |
|---|---|
| Real (path is feasible) | 246 |
| False positive | 631 |
| Unverified | 17 |

Of the 246 real rows, 88 are under app/ (75 in app/test unit tests), and a further
group is harmless (zero-length memcpy with NULL, uninitialised bytes copied but never
used, redundant NULL checks). The rest are the lib/driver bugs below. Several rows
share one root cause.

Coverage:
- 47 rows in the small classes (double-free, use-after-free, fd, infinite-loop,
  overlapping-buffers, deref-before-check): event path and source read for each.
- 847 rows in the bulk classes: triaged by seven separate passes. Non-header rows were
  read individually; repeated patterns (ifpga feature lookups, ring n=1 wrap, failsafe
  ETH(), test_cryptodev allocs, test failure-path leaks) were judged as a group from
  2-4 full paths plus a source check of the rest.
- (v) = the decisive source lines were re-read in a second pass. Items without (v)
  rest on one reading.
- Nothing was compiled or run; no source was changed.

## 1. Double free, bad pointer, wrong data

| Where | Problem |
|---|---|
| drivers/net/bnxt/tf_core/v3/tfc_msg.c:160,176 (v) | `tfc_msg_alloc_dma_buf()` frees `buf->va_addr` when virt2iova fails and leaves it set; the caller's cleanup frees it again. 5 callers. `tfc_msg_idx_tbl_set()` also calls the alloc twice (:647 and :653), leaking the first buffer on every DMA-sized set. |
| drivers/net/nfp/nfpcore/nfp_elf.c:870,275 (v) | `nfp_elf_read_section_headers()` frees `shdrs`/`shdrs_data`/`shdrs_host_endian` on error without clearing them; `nfp_elf_mutable_buf()` then calls `nfp_elf_free()`. Double free on a malformed firmware ELF. |
| drivers/bus/fslmc/fslmc_vfio.c:483,544 (v) | `fslmc_vfio_check_extensions()` closes the container fd on ioctl failure; the caller closes it again. |
| drivers/bus/fslmc/fslmc_vfio.c:1325-1328 (v) | return of `fslmc_vfio_setup_device()` ignored; `ioctl()` on uninitialised `mc_fd`. |
| lib/pipeline/rte_swx_ctl.c:3131,2896 (v) | table entry parser looks the action up globally, not per table; `entry->action_data` is sized for the table (or NULL). An action with larger args writes past it. Control-plane input. |
| lib/pdcp/pdcp_process.c:59,146,167 (v) | `rte_pktmbuf_prepend()` result used unchecked; NULL write when headroom < 8. |
| drivers/crypto/ccp/ccp_crypto.c:2034,2121 (v) | `rte_pktmbuf_append()` unchecked in AES-CMAC; NULL+32 write when tailroom < 64. Same at :1575, :1744, :2375. |
| drivers/net/nfp/nfd3/nfp_nfd3_dp.c:184 (v) | `rte_pktmbuf_prepend()` unchecked on Tx metadata. |
| drivers/net/r8169/r8169_rxtx.c:1568-1571 (v) | append failure is logged, then `memset(NULL, 0, pad_len)`. |
| drivers/net/zxdh/zxdh_common.c:230 (v) | `rte_memcpy(res, ..., tbl_reps->len)` with device-supplied length into a 1-byte caller buffer. |
| drivers/crypto/cnxk/cnxk_se.h:1259,317,556 (v) | SM4-ECB (no IV), SG mode, cipher offset not 8-aligned: memcpy of `pad_len` bytes from NULL `iv_buf`. |
| drivers/crypto/mlx5/mlx5_crypto_gcm.c:433,222 (v) | setup error path calls `qp_release()`, which reads `queue_pairs[qp_id]` (not yet assigned): NULL deref, new qp leaked. |
| drivers/net/bnxt/bnxt_rxtx_vec_sse.c:448,498 (v) | `rxcmp1[]` in `crx_burst_vec_sse()` is never written; `GET_DESC_FIELDS` blends it into `vlan_tci` of every mbuf on the compressed-CQE SSE Rx path. |
| drivers/net/intel/ice/ice_dcf_vf_representor.c:233 (v) | `ice_dcf_vf_repr_hw()` returns NULL once `dcf_valid` is cleared; vlan offload/pvid/tpid ops dereference it. |
| drivers/net/cxgbe/cxgbe_filter.c:179-182 (v) | `WARN_ON(!mbuf)` only logs; NULL deref on pool exhaustion. |
| drivers/compress/octeontx/otx_zip_pmd.c:255 (v) | frees `vf->zip_mp` (old or NULL) instead of the just-created `zip_buf_mp`. |
| drivers/net/cnxk/cnxk_rep_msg.c:338-343 (v) | for 8-byte acks the freshly allocated `adata->u.data` is overwritten by the memcpy (leak); allocation unchecked. |
| drivers/net/intel/cpfl/cpfl_flow_parser.c:1989 | `prog->prog` NULL when a JSON mod rule has a "parameter" content field but no prog action. |
| drivers/net/intel/cpfl/cpfl_representor.c:563,662 (v) | `ret` returned uninitialised when the allowlist loop creates nothing. |
| drivers/net/xsc/xsc_rx.c:231-240 (v) | BAD_IOVA path leaks the buffer and later uses the bad pointer. |
| drivers/crypto/ccp/ccp_dev.c:547-549 (v) | memzone reserve result unchecked. |
| drivers/net/dpaa2/dpaa2_recycle.c:406,469 (v) | `lsx_ccsr_map_region()` NULL (no /dev/mem) dereferenced. |
| drivers/raw/ifpga/base/ifpga_feature_dev.c:99,197 (v) | PR_MGMT / port ERROR feature lookup unchecked (hardware without the feature). |

## 2. Leaks in normal operation

| Where | Problem |
|---|---|
| lib/pipeline/rte_swx_pipeline_spec.c:2893,2210 (v) | `pipeline_spec_free()` memsets `s` but never frees it; leaks on every parse, success or failure. |
| drivers/net/cnxk/cnxk_rep_msg.c:552 (v) | `send_ack_message()` never frees `buffer`. |
| drivers/net/sfc/sfc_tbl_meta_cache.c:137 (v) | `fields` not freed on success. |
| drivers/net/zxdh/zxdh_flow.c:1256,1664 (v) | `flow` allocated when `dh_flow == NULL` (validate) is not freed on the `return 0` paths (:1494, :1831). |
| drivers/net/cxgbe/cxgbe_main.c:688 | `pi->rss` has no matching free anywhere in the driver. |
| drivers/net/mana/mana.c:2189,2236 (v) | secondary-process probe leaks `priv`. |
| drivers/raw/ntb/ntb.c:1240,1270 (v) | `xstats_names` leaked for an unknown name; allocation unchecked. |
| app/test-eventdev/test_perf_common.c:592 | `src`/`dst` never freed. |
| app/graph/l2fwd.c:34,46; l3fwd.c:76,90 | `node_patterns`, `pcap_filename` never freed (one-shot). |

## 3. Leaks on error paths (init/setup failure)

lib:
- lib/pdump/rte_pdump.c:403 (v): BPF filter not destroyed on the later error returns.
- lib/node/kernel_rx.c:214,222 (v): `recv_info` when `socket()` fails.
- lib/graph/graph_stats.c:354: `x = realloc(x, ...)`.
- lib/eal/linux/eal_dev.c:207: duplicate `PCI_SLOT_NAME=` key (theoretical).

drivers:
- bnxt/bnxt_ethdev.c:5043-5097 (ctx_pg_arr / ctx_dma_arr)
- intel/cpfl/cpfl_ethdev.c:2201-2213, 3096-3114; intel/idpf/idpf_ethdev.c:1666-1677
- intel/ice/base/ice_xlt_kb.c:135-148
- ntnic/ntnic_ethdev.c:2326 (p_drv)
- cnxk/cnxk_eswitch_flow.c:395, cnxk_rep.c:398, cnxk_tm.c:306, cnxk_tm.c:394
- failsafe/failsafe_ops.c:461-481 (v), gve/gve_tx_dqo.c:605-619 (v), ionic/ionic_lif.c:~691
- memif/rte_eth_memif.c:169, 1326, 1388, 1774 (v), 1812
- nbl/nbl_hw/nbl_channel.c:943; nbl_channel.c:596-607 (v): mailbox pipe fds not closed when thread create fails
- nfp/nfdk/nfp_nfdk_dp.c:460, nfp/nfp_ethdev.c:2847
- ring/rte_eth_ring.c:548-561, sfc/sfc.c:1435, softnic/rte_eth_softnic_thread.c:69
- vmxnet3/vmxnet3_rxtx.c:1047 (v), 1151; xsc/xsc_dev.c:359
- baseband/la12xx/bbdev_la12xx.c:891, bus/dpaa/base/fman/fman.c:60, common/qat/qat_qp.c:844,879
- raw/cnxk_gpio/cnxk_gpio.c:254-267, raw/ifpga/base/opae_i2c.c:472, opae_intel_max10.c:1358
- bus/platform/platform.c:301 (next to the flagged line: `name[i]` not freed)

## 4. Unchecked allocation (crash on malloc failure)

nfp/nfpcore/nfp_nsp.c:551, xsc/xsc_ethdev.c:546, cnxk/cnxk_rep_msg.c:391,419,451,613,
cnxk/cnxk_rep_flow.c:213,223, intel/idpf/idpf_common_virtchnl.c:439,
ntnic/nthw/flow_api/flow_id_table.c:68, ntnic/nthw/model/nthw_fpga_model.c (5 `*_new`),
crypto/caam_jr/caam_jr.c:2197,2202, event/opdl/opdl_test.c:988, app/test-dma-perf/main.c:190

## 5. Real but harmless

- lib/eventdev/rte_event_eth_rx_adapter.c:2961 (v): `rxa_sw_vector_limits()` leaves `log2_sz` unset (returned to the caller and traced).
- lib/compressdev/rte_compressdev.c:59: NULL capabilities if a PMD has no `dev_infos_get` (none in tree).
- lib/eal/common/eal_common_dev.c:405: `local_dev_remove(NULL)` on a narrow rollback path.
- net/ena/ena_ethdev.c:3677 (v): `metrics_stats[]` copied to xstats uninitialised when the admin command fails.
- net/octeon_ep/otx_ep_mbox.c:343: `rsp` read after a failed send.
- net/mlx5/mlx5_rx.c:1252, net/cxgbe/cxgbe_ethdev.c:616, intel/ixgbe/ixgbe_ethdev.c:5322, ixgbe_e610.c:240,395, hinic3_nic_cfg.c:701, cn10k/cn20k tls13_trim_mac: uninitialised value read, result unused.
- memcpy(NULL, x, 0) or memcpy(x, NULL, 0): crypto/cnxk/cnxk_ae.h:1242,1381 (12 rows), caam_jr.c:1564-1613, nbl_channel.c:737, netvsc/hn_rndis.c:593.
- lib/bpf/bpf_exec.c:487 (reg[5] passed to xsym), lib/telemetry/telemetry_json.h:45 (documented).
- net/bnxt/bnxt_ethdev.c:5196, net/ntnic/ntnic_ethdev.c:2688: redundant NULL check after dereference.
- app/proc-info/main.c:395 (v): `--collectd-format` given twice dups/closes a closed fd.

## 6. Test code and tools

- app/test-compress-perf/comp_perf_test_cyclecount.c:147,460 (v): `ops` freed in `cperf_cyclecount_op_setup()` and again in `main_loop()`.
- app/test-regex/main.c:222,310 (v): `read_file()` frees `*buf`, `init_port()` frees it again; :726 `rules_file` used uninitialised without `--rules`.
- app/test-crypto-perf/cperf_ops.c:429: `m->next` NULL after `rte_pktmbuf_reset()` (option dependent).
- app/test-fib/main.c:1131,1193, app/test-flow-perf/main.c:1865: leaks at exit.
- app/test/test_cryptodev.c: ~25 sites with unchecked `rte_pktmbuf_alloc()`; test_dmadev.c:308; 5 other unchecked allocs.
- app/test: 33 leaks on a test's failure-return path (test_bitset, test_lpm, test_lpm6, test_fib6, test_bpf, test_malloc, test_rcu_qsbr, ...).
- app/test: uninitialised reads in test_bitset.c:643, test_event_eth_tx_adapter.c:494, test_stack.c:524 (benign).

## 7. False-positive patterns (634 rows)

| Pattern | Rows (approx.) |
|---|---|
| ifpga: feature ops looking up their own feature, list invariant not visible | 96 |
| Pointer stored in a long-lived struct (`dev->data->mac_addrs`, queue arrays, lists, registries) reported as a leak | ~95 |
| rte_ring: n=1 enqueue/dequeue taking the wrap branch (`idx = head & mask` not related to `size`); rcu_qsbr `alloca(esize)` allocation-size | ~75 |
| Same condition assumed true and false on one path; invariants guarded by other code | ~120 |
| failsafe `ETH(sdev)` NULL (sub-device state guards) | 19 |
| intel common flow engine: `actions[0]` / engine ref non-NULL by construction | 19 |
| cnxk/cpt crypto session-type invariants | ~25 |
| Loop bound clamped at assignment (bnxt num_leds, tfc num_lvl, hugepage sizes, ...) | ~25 |
| LIST/TAILQ remove-then-free loops reported as double-free / use-after-free (eal_alarm, swx_ctl, vdev_netvsc, xsc, mlx5) | 12 |
| Busy-wait loops on hardware/atomic state reported as infinite loops | 10 |
| Negative tests and deliberately dropped handles in app/test | ~20 |
| `rte_flow_error_set()` / external helper assumed to return 0 | ~10 |
| Other one-offs | remainder |

Checked individually among these: lib/eal/linux/eal_alarm.c:110,225, lib/pipeline/rte_swx_ctl.c:292-294,
lib/graph/graph_stats.c:202,211, drivers/bus/pci/linux/pci_uio.c:339, virtio_user/vhost_kernel.c:432,
app/test-pmd/cmdline.c:9614, bonding rte_eth_bond_8023ad.c:358, the three `shuffle_input_keys()` memcpy
warnings (`swap_idx = rand % i` is never `i`), nbl_dev.c:210.

## 8. Unverified (17 rows)

- drivers/net/zxdh/zxdh_np.c:325,4801-4831 (5 rows): SDT parser writes a HASH/ETCAM-sized struct into a 20-byte ERAM struct if the sdt_no type differs; sdt_no sources not traced.
- drivers/net/zxdh/zxdh_ethdev.c:751: `hdr_mz` NULL if a Tx queue has 0 descriptors.
- drivers/net/pfe/pfe_hif_lib.c:445: `first_mbuf` NULL if a call starts mid-packet.
- drivers/net/enetfec/enet_rxtx.c:123: `rte_pktmbuf_adj()` NULL on a very short frame.
- drivers/net/bnxt/bnxt_hwrm.c:6207,6244,6301: `buf` leaked if `HWRM_PREP` returns early; needs `hwrm_cmd_resp_addr == NULL`.
- drivers/net/bnxt/tf_ulp/ulp_mapper.c:4060: cond list NULL for an out-of-range template index.
- drivers/bus/dpaa/base/qbman/qman.c:951: `fq` NULL guarded only by `DPAA_BUG_ON` (compiled out).
- app/test-crypto-perf/cperf_ops.c:491; app/test/test_graph_feature_arc.c:327,1278,1290.

## 9. Noticed in passing (not analyzer findings, not verified)

- lib/vhost/vhost_crypto.c:857: `*cur_desc = desc + 1` can point one past the last descriptor.
- lib/vhost/vduse.c:213-218: two `rte_malloc_socket()` results unchecked.
- drivers/net/softnic/rte_eth_softnic_thread.c: free loop covers workers only, init covers all lcores.
- drivers/net/mlx5/mlx5_hws_cnt.h:346-350: ring reservation size guarded only by MLX5_ASSERT.
- app/test/test_malloc.c:519-522: `ptr3` leaked when the second realloc fails.