DF-0207 clist_alloc_cblocks memory leak - vmstat -m (M_TTYS) before/after harness load Harness: 3000 iterations, each calling clist_alloc_cblocks(cl,4096) then clist_alloc_cblocks(cl,1024) -> each call with a new ccmax orphans the previous kmalloc'd c_data buffer. BEFORE kldload: ttys Count=37 MemUse=143K Requests=76 AFTER kldload: ttys Count=5.90K MemUse=29.4M Requests=5.93K DELTA: ~5863 live c_data buffers orphaned, ~29MB of M_TTYS permanently leaked. (clist_free_cblocks at unload only frees the LAST live buffer; the ~3000 prior buffers are unreachable => permanent kmem leak.) This is direct proof the bug at sys/kern/tty_subr.c:80 (cl->c_data = data without kfree of the old pointer) leaks on every resize. Impact ceiling: unbounded M_TTYS kmem exhaustion (DoS) on any code path that changes a clist's ccmax (sio serial baud changes, netgraph/sl drivers, or any tty whose t_*speedwat != 0).