{
  "finding_id": "DF-5593",
  "title": "cam_sim_free() orphans the sim's ccb pool -- deterministic kernel heap leak per controller detach",
  "verdict": "reproduced",
  "impact": "leak",
  "reproduce": {
    "build": "sh build.sh   (in guest /root/df5592; builds ptsim3/ptsim3.ko)",
    "run": "kldload ./ptsim3/ptsim3.ko; vmstat -m > b; sysctl debug.ptsim3.scan=1; sleep 3; sysctl debug.ptsim3.go=3; vmstat -m > a",
    "expected": "'DF-5593: sim->ccb_count=8, ccb_freeq length=8 ... 8 ccbs orphaned'; CAM_XPT vmstat count never returns after the detach"
  },
  "kernel_refs": [
    "sys/bus/cam/cam_sim.c:241-256",
    "sys/bus/cam/cam_xpt.c:4958-4975",
    "sys/bus/cam/cam_xpt.c:4247-4271"
  ],
  "artifacts": [
    "ptsim3.c", "build.sh", "build.log", "run.log",
    "README.md", "VERDICT.md", "manifest.json", "verdict.json", "env.txt"
  ]
}