# DF-5377 decisive run 1: 8 leak cycles (guest stays alive)
root@dfbsd# kldload ./targsim.ko
root@dfbsd# sysctl vm.pbuf_mem_count
vm.pbuf_mem_count: 394
root@dfbsd# ./poc5377 8
[*] DF-5377: vm.pbuf_mem_count=394; running 8 leak cycles (drain=0)
[*] 8/8 cycles, pbuf_mem_count=386 (leaked so far: 8)
[*] after : vm.pbuf_mem_count=386 (expected 386 = 394-8)
[+] REPRODUCED: exactly one pbuf leaked per cycle, never released (cam_periph_mapmem bp[0] dropped by targdone's not-enabled targfreeccb path)
rc=0
root@dfbsd# sysctl vm.pbuf_mem_count hw.targsim.held_total
vm.pbuf_mem_count: 386
hw.targsim.held_total: 8