kern/60559: nvmm(4): memory leak in nvmm_machine_destroy

>Number:         60559
>Category:       kern
>Synopsis:       nvmm(4): memory leak in nvmm_machine_destroy
>Confidential:   no
>Severity:       serious
>Priority:       medium
>Responsible:    kern-bug-people
>State:          open
>Class:          sw-bug
>Submitter-Id:   net
>Arrival-Date:   Sat Aug 08 14:40:00 +0000 2026
>Originator:     Taylor R Campbell
>Release:        current, 11, 10, 9
>Organization:
The NvmmBSD Foundaleak, Inc.
>Environment:
>Description:

	nvmm_machine_create creates a uao (uvm anonymous object), but
	nvmm_machine_destroy appears to be missing any free:

    318 static int
    319 nvmm_machine_create(struct nvmm_owner *owner,
    320     struct nvmm_ioc_machine_create *args)
    321 {
...
    338 	mach->vm = uvmspace_alloc(0, mach->gpa_end - mach->gpa_begin, false);
    339 
    340 	/* Create the comm uobj. */
    341 	mach->commuobj = uao_create(NVMM_MAX_VCPUS * PAGE_SIZE, 0);
    342 
    343 	(*nvmm_impl->machine_create)(mach);
...
    349 }
    350 
    351 static int
    352 nvmm_machine_destroy(struct nvmm_owner *owner,
    353     struct nvmm_ioc_machine_destroy *args)
    354 {
...
    375 	(*nvmm_impl->machine_destroy)(mach);
 => 376 
    377 	/* Free the machine vmspace. */
    378 	uvmspace_free(mach->vm);

https://nxr.netbsd.org/xref/src/sys/dev/nvmm/nvmm.c?r=1.48#318

>How-To-Repeat:

	code inspection

>Fix:

	uao_detach(mach->commuobj);