# DF-2687 round 2 — pin experiment (guest snapshot #1, 2026-10-16)
# Question: does the orphaned tty's session chunk free while the orphan
# slave is held open (the finding's model: "session already freed at hold
# time"), or is it pinned by the orphan's leaked t_pgrp reference until
# the orphan's own close (chained free inside ttyclearsession)?

$ cc -O2 -o /tmp/df2687x df2687x.c && /tmp/df2687x pin 8 8   (as maxx)
PIN: 8 orphans held (units 0 2 4 6 8 10 12 14) built in 0.004s; HOLDING 8s
PIN: hold done, closing orphans
PIN: close(unit 0) rc=0 errno=0 0.2843ms
PIN: close(unit 2) rc=0 errno=0 0.2251ms
PIN: close(unit 4) rc=0 errno=0 0.3294ms
PIN: close(unit 6) rc=0 errno=0 0.4304ms
PIN: close(unit 8) rc=0 errno=0 0.2323ms
PIN: close(unit 10) rc=0 errno=0 0.4465ms
PIN: close(unit 12) rc=0 errno=0 0.2308ms
PIN: close(unit 14) rc=0 errno=0 0.2887ms
PIN: all closed
PIN_RC=0

# Root-side M_SESSION in-use sampling around a second 8-orphan hold:
root# B=$(vmstat -m|awk '$1=="session"{print $2}'); \
      su -m maxx -c "/tmp/df2687x pin 8 6" & sleep 3; \
      M=$(vmstat -m|awk '$1=="session"{print $2}'); wait; \
      A=$(vmstat -m|awk '$1=="session"{print $2}'); \
      echo "BEFORE=$B MIDHOLD=$M AFTER=$A"
BEFORE=19 MIDHOLD=27 AFTER=19

# RESULT: MIDHOLD = BEFORE + 8  ==>  ALL 8 session chunks remain ALLOCATED
# while the orphan slaves are held open.  They free exactly at close()
# (AFTER back to baseline).  The finding's "session already freed (leader
# reaped)" hold-time model is wrong; the free is chained into the orphan's
# own final close: ttyclearsession() -> pgrel(leaked pgrp) -> sess_rele()
# -> kfree(session), ~10 instructions before the same function reads
# tp->t_session->s_prg.  There is NO persistent reclaim window.