DF-0207 / leak_sample.txt
DF-0207 clist_alloc_cblocks memory leak - vmstat -m (M_TTYS) before/after harness load
Harness: 3000 iterations, each calling clist_alloc_cblocks(cl,4096) then clist_alloc_cblocks(cl,1024)
-> each call with a new ccmax orphans the previous kmalloc'd c_data buffer.
BEFORE kldload: ttys Count=37 MemUse=143K Requests=76
AFTER kldload: ttys Count=5.90K MemUse=29.4M Requests=5.93K
DELTA: ~5863 live c_data buffers orphaned, ~29MB of M_TTYS permanently leaked.
(clist_free_cblocks at unload only frees the LAST live buffer; the
~3000 prior buffers are unreachable => permanent kmem leak.)
This is direct proof the bug at sys/kern/tty_subr.c:80 (cl->c_data = data without kfree
of the old pointer) leaks on every resize. Impact ceiling: unbounded M_TTYS kmem exhaustion
(DoS) on any code path that changes a clist's ccmax (sio serial baud changes, netgraph/sl
drivers, or any tty whose t_*speedwat != 0).