Not directly related to the patch, but: nl_pru_attach() does not count its ucred reference, i.e., it does not use crhold() when copying the socket's reference. However, nl_pru_detach() uses a deferred free and does not set nl_cred = NULL before returning to sodealloc(), which releases the ucred reference, so there is a window where netlink holds a dangling ucred reference.

I'm not familiar with the netlink part, others look good to me.