Unbounded heap growth while interface parked in IPv4LL with no DHCP server (10.1.0)

[adinamariav]

Version

dhcpcd 10.1.0
Compiled in features: INET ARP ARPing IPv4LL INET6 DHCPv6 AUTH PRIVSEP
[stock Debian package 1:10.1.0-N]

Environment

• OS: Debian trixie, kernel 6.12.73+deb13-amd64
• Invoked per-interface via ifupdown (iface eno1 inet dhcp), privsep enabled
• dhcpcd.conf: distro default

Summary

The main dhcpcd process grows in RSS without bound when an interface has
carrier but no DHCP server answers, so it stays in IPv4LL and retries
indefinitely. Growth is roughly linear at ~64 MB/day. The privsep proxy
processes stay at 2–3 MB; only the master process grows.

Evidence

RSS over ~14 days on a host with ~102 days uptime, interface stuck in IPv4LL:
day 0: RSS 1,672,632 kB
day 14: RSS 2,571,712 kB (~64 MB/day)

smaps_rollup (master pid):
Rss 2,571,712 kB / Anonymous 2,568,464 kB / Private_Dirty 120,400 kB
AnonHugePages 2,564,096 kB / Swap 0 kB
pmap: a single anonymous mapping holds essentially all of RSS.
%CPU: 0.0 (steady state, not a busy loop).

The allocation is overwhelmingly clean, zero-backed anonymous heap , consistent
with zero-allocated buffers created each retry cycle and never freed.

Trigger

Interface UP + LOWER_UP, no DHCP server reachable. tcpdump shows DHCPDISCOVER
broadcasts going out with normal exponential backoff and zero replies; the
interface holds a 169.254/16 address. dhcpcd -U <iface> reports only
reason=CARRIER and reason=IPV4LL, never BOUND.

Ruled out

• Not CPU-bound (0% CPU), so not the known IPv4LL spin loops.
• Not a single oversized one-shot allocation, it grows monotonically over days.
• Helper/proxy processes are flat; the leak is in the master only.

Reproduce

1. Configure an interface for DHCP with carrier up but no DHCP server on the segment.
2. Let dhcpcd fall to IPv4LL.
3. Sample grep VmRSS /proc/$(pidof -s dhcpcd)/status over hours/days.
   RSS climbs steadily with no lease ever obtained.