# DF-4672 — METEORSETGEO grow path leaks the old frame buffer's pages (wired / DMA-reserve)

**Status: REPRODUCED (dos). Unprivileged uid 1001 → +203.7 MiB permanent
wired leak (and silent 256 MiB DMA-reserve drain) via production
`video_ioctl` on the stock unfixed bktr.ko, driven through the DF-1215
KLD rig on the hardware-less audit guest. Fix validated on a rebuilt
kernel (leak gone).**

## Build

```
./build.sh        # cc poc_wireleak.c + KLD rig (needs /usr/src + /usr/obj headers)
```

## Run

```
./run.sh          # root: rig load + attach-mirror init; maxx: the grow storm
```

## Expected (baseline / stock kernel)

```
wire before grows: 155684
grow #40 -> wire_delta=+1511   >>> WIRE CLIMB PHASE BEGINS
grow #64 -> wire_delta=+28234
== RESULT ==
wire delta (permanent)  : 52137 pages (203.7 MiB)
WIRED-MEMORY LEAK CONFIRMED (pages wired by the grow path are never returned)
```

On the fixed kernel (DF467XFIX): wire delta ≈ 0 for the same grow storm.