# DF-0207 — Memory leak in clist_alloc_cblocks (missing kfree of old c_data)

See **VERDICT.md** for the full analysis (root cause, proof, reachability nuance).

## Reproduce (the leak)
```sh
./build.sh                 # builds the userspace trigger + the kld harness
sudo ./run.sh              # kldload harness; vmstat -m | grep ttys before/after
```
UNPATCHED kernel: M_TTYS MemUse jumps 143K -> ~29M (leak).
FIXED kernel:    M_TTYS MemUse stays 143K (flat, no leak).

The harness (df0207_harness.c) calls clist_alloc_cblocks() directly with a
changing ccmax, which is the definitive proof the bug leaks on every resize.

## Fix
`fix.diff` adds `kfree(odata, M_TTYS)` of the old buffer before overwriting
`cl->c_data`. Validated: single-fix kernel #1 boots; harness no longer leaks
(M_TTYS flat). See `fix_run.log`.