# DF-5683 — sys_vquotactl() leaks the entire prop object graph on every call (unprivileged)

## What
`sys_vquotactl()` (sys/kern/vfs_quota.c:328-413) — the consumer of
`prop_dictionary_copyin()` from sys/libprop/prop_kern.c — never releases any
of the objects it creates or copyin'd:

- vfs_quota.c:346  `dict` from `prop_dictionary_copyin()` — never released
- vfs_quota.c:362  `cmd` from `prop_dictionary_get_cstring()` (an allocated
                    copy, prop_dictionary_util.c:183-198) — never freed
- vfs_quota.c:374  `pa_out` from `prop_array_create()` (+ every item added by
                    `cmd_get_usage_all()`) — never released
- vfs_quota.c:405  `dict = prop_dictionary_create()` (reassigns over the still-
                    un-released copyin'd dict) — never released
- vfs_quota.c:351-356 error paths return without `nlookup_done(&nd)`, leaking
                    nlookup root/namecache references per failing call

## Reachability
syscall 530 `vquotactl(2)`, **no privilege required** (there is no priv check
anywhere in the function); gated only on the `vfs.quota_enabled` boot tunable.
Base-system `vquota(8)` ("show"/"sync"/"limit"/"ulim"/"glim") drives it.

## Reproduce (baseline, vulnerable kernel)
1. boot guest with `vfs.quota_enabled=1` in /boot/loader.conf
2. `cc -O2 -o vq_leak_loop vq_leak_loop.c`
3. as an unprivileged user:
   - `vmstat -m | grep -i prop` (t0)
   - `./vq_leak_loop / 1000` ; snapshot t1 ; `./vq_leak_loop / 1000` ; snapshot t2

## Expected output (vulnerable kernel)
Linear growth of prop malloc types, ~1.6 KB kernel heap per call:
  t0: propdict 178 / proparay 9 / prop_string 319
  t1: propdict 3100 (+2920) / proparay 1009 (+1000) / prop_string 2260
  t2: propdict 6030 (+2930) / proparay 1960 (+950) / prop_string 4220
(≈ +1.9 MB live kernel memory per 1000 unprivileged syscalls, unreclaimable)

## Expected output (patched kernel, fix.diff applied)
prop malloc types FLAT across 2000 calls (+2 allocs total).

## Files
- vq_leak_loop.c   tight in-process driver (raw syscall 530, hand-crafted XML)
- vq_leak.sh       shell variant driving /sbin/vquota
- build.sh / run.sh
- build.log / run.log (baseline) / run.patched.log (fix validation)
- fix.diff         minimal leak fix (git-applyable, sys/kern/vfs_quota.c)
- fix_combined.diff  the combined diff actually built & validated in the guest
- fix_build.log / fix_run.log
- VERDICT.md / manifest.json / verdict.json