# Stock kernel (INVARIANTS #0), PoC "hold 25" mode (orphaned slave held open,
# session leader already exited+reaped, session kfreed by sess_rele).
# Decoded from sysctl kern.ttys (struct tty blobs, sizeof=376):
kern.ttys: 4512 bytes, sizeof(struct tty)=376, count=12
[01] state=01100020 line=0 dev=0x2100 pgrp=0xfffff80117f398d0 session=0xfffff80116d4e970 refs=0  <== ORPHANED TTY WITH LIVE t_session POINTER
# state = TS_REGISTERED|TS_ZOMBIE|TS_ISOPEN (master closed by ptcclose, slave
# still open), t_refs=0 (hold dropped by 2nd TIOCSCTTY), t_session NON-NULL
# pointing at the freed session, t_pgrp pointing at the dead leader's pgrp
# (leaked reference).