# DF-5593 — cam_sim_free() orphans the sim's ccb pool (deterministic kernel heap leak per controller detach)

`sys/bus/cam/cam_sim.c` pass-2 — `cam_sim_release()` final free path.

## What

ccbs are pooled per-sim: `xpt_get_ccb()` (cam_xpt.c:4958-4975) allocates from /
`xpt_release_ccb()` (cam_xpt.c:4247-4271) returns ccbs to `sim->ccb_freeq`,
bounded by `sim->max_ccbs` (grown per attached device at cam_xpt.c:5156/5253).
When the sim dies, `cam_sim_release()` (cam_sim.c:246-252) drops the devq and
`kfree(sim)` — but **never drains `sim->ccb_freeq`**: every pooled
`union ccb` (~720 B + a `struct callout`, both M_CAMXPT) is orphaned. Nothing
else can free them: `xpt_free_ccb()` is only reachable through a live sim's
release accounting.

Every storage-controller detach after I/O (kldunload, hot-plug removal,
surprise removal) leaks its pool; repeated cycles grow the kernel heap
without bound.

## Reproduce (guest)

```
sh build.sh
kldload ./ptsim3/ptsim3.ko
vmstat -m > before.txt
sysctl debug.ptsim3.scan=1 ; sleep 3      # probe churn fills the pool
sysctl debug.ptsim3.go=3                  # clean deregister+free, prints pool size
vmstat -m > after.txt                     # CAM_XPT count never returns
```

Measured on the stock guest: `sim->ccb_count=8, ccb_freeq length=8` reported
at detach; CAM_XPT in-use count 40 → 69 across the scan with zero return
after the detach (see run.log).

## Fix (recommended, in the fixed-free branch of cam_sim_release)

```c
	struct ccb_hdr *ch;

	while ((ch = SLIST_FIRST(&sim->ccb_freeq)) != NULL) {
		SLIST_REMOVE_HEAD(&sim->ccb_freeq, xpt_links.sle);
		xpt_free_ccb(ch);
		sim->ccb_count--;
	}
```