/*
 * DF-2556 PoC — clist_alloc_cblocks() leaks the previous c_data buffer.
 *
 * Bug (sys/kern/tty_subr.c:48-81):
 *   clist_alloc_cblocks() kmalloc()s a new `data` buffer (line 61), copies the
 *   old contents, then overwrites `cl->c_data = data` (line 80) WITHOUT ever
 *   kfree()ing the previous cl->c_data. Every reallocation to a *different*
 *   non-zero size therefore leaks one M_TTYS allocation. The ccmax==0 path
 *   correctly calls clist_free_cblocks(); the ccmax==c_ccmax path returns early;
 *   only the "resize to a different size" path leaks.
 *
 * Live userspace trigger: TIOCSETA on a sio(4) serial tty (the only driver that
 * sets t_ispeedwat/t_ospeedwat = (speed_t)-1, sys/dev/serial/sio/sio.c:2480),
 * so that a baud-rate change actually changes the computed clist size
 * (tty.c:1085 ttsetwater -> tty.c:2457/2489 clist_alloc_cblocks). A user logged
 * in on such a serial port can leak kernel memory per baud-rate change.
 *
 * GUEST LIMITATION: this QEMU guest has exactly one sio tty, /dev/ttyd0, which
 * is the kernel console (comconsole). The console subsystem locks its speed
 * (verified: `stty -f /dev/ttyd0 9600` returns silently but `speed` still
 * reports 115200; tcsetattr returns 0 but tp->t_ospeed is unchanged), so the
 * clist size never changes via TIOCSETA and no leak can be induced from
 * userspace on this guest. There is no second/non-console serial port.
 *
 * Therefore this file demonstrates the leak PRIMITIVE at the function level:
 * a tiny diagnostic module (leak_mod.c) calls clist_alloc_cblocks() directly
 * with alternating sizes and we measure M_TTYS growth. On the unpatched kernel
 * M_TTYS grows monotonically (each resize leaks the old buffer); on the fixed
 * kernel (kfree of old c_data) it stays flat. This is the same kind of
 * function-level primitive confirmation used for harness-only findings.
 *
 * Files:
 *   leak_mod.c  - kernel module: clist_alloc_cblocks resize loop (the harness)
 *   build_mod.sh / run_mod.sh - build & run the module (root: kldload)
 *   poc.c       - the (guest-limited) live userspace trigger against a sio tty
 */