# DF-4474 PoC — proplib object leaks on dm ioctl error paths

**Build** (guest, after `vm.sh reset with-src` + `kldload dm`):

```sh
cc -o dm_errleak dm_errleak.c -lprop
```

**Run**:

```sh
./dm_errleak 100 20000        # failed-reload rounds, deps/status rounds (400-entry trees)
./dm_errleak 60 0 4000        # few rounds, huge 4000-entry trees (page-accounting variant)
```

**Expected (unpatched)**:

* M_TEMP InUse grows by exactly +1 object per failed reload and never drops
  (470 → 570 → 670 ...); with 4000-entry trees the free-page count drops by
  ~3.5MB per failed reload and does not return.
* deps/status ENOENT loops leak their cmd_array (code-evident; per-object
  zone accounting masks the count).

**Expected (patched with fix.diff)**: InUse unchanged (470 → 470) after
200 failed reloads + 60000 deps/status calls; free pages healthy.

Requires root (or operator group).