# DF-5361 -- CISTPL_END MFC reset frees the pf structs but leaks every cfe on their chains (per-insertion kernel heap leak; unbounded with DF-5362)

File: sys/bus/pccard/pccard_cis.c (verify pass, GLM 5.3).  Full narrative: VERDICT.md.

## Reproduce (verbatim production parser, guest toolchain, no PCMCIA HW needed)
    ./build.sh          # sh extract.sh .  &&  cc -O2 -Wall -o rig rig_main.c
    ./run.sh            # baseline scenarios: ./rig mfcleak && ./rig benign
    sh run_matrix.sh    # A/B: baseline vs each single-fix variant, all scenarios

Expected decisive output (DF-5361): BASELINE: mfcleak card (CONFIG+CFTABLE+CFTABLE+MFC+NO_LINK+END, then a clean MFC chain) parses to normal termination with LEDGER 'alloc cfe=2 pf=1 | kfree cfe=0 pf=1 | LIVE cfe=2' -- 2 x 160-byte pccard_config_entry blocks orphaned by the reset at :638-644. The benign VALID 2-function MFC card also leaks its single pre-MFC cfe (LIVE cfe=3 of which 1 orphaned) -- the leak fires on well-formed cards, not only crafted ones. WITH fix.diff (f5361): LIVE cfe=0 and benign LIVE cfe=2 (only the entries belonging to the two live functions, freed by the correct teardown); everything else unchanged.

## What it proves
The rig executes the **byte-identical production parser** extracted from the
guest's /usr/src (sha256-gated; extract_manifest.txt) through the real entry
`pccard_read_cis()`. Kernel entry is hardware-gated (no PCMCIA bridge in
QEMU) -- see VERDICT.md for the method, the A/B matrix, and the
booted-combined-fix-kernel validation.

Recommended fix: Drain pf->cfe_head (STAILQ_REMOVE_HEAD + kfree) before kfree(pf) in the MFC reset, mirroring pccard_detach_card pccard.c:317-324. (fix.diff; validated, see fixed_run.log /
matrix.log / postboot_run.log).

Note: `poc_pccard_cis2.c` is the seeded hand-written model from the earlier
model-only verdict (status was `untested`); it is kept for history and is
SUPERSEDED by the verbatim rig (`extract.sh` + `rig_main.c` + `rig_shims.h`)
which reproduces its numbers on the byte-identical production parser.