DF-5683 BASELINE RUN (vulnerable kernel #0: Thu Jul  2 06:02:54 UTC 2026, vfs.quota_enabled=1)
Driver: /tmp/vq_leak_loop (uid=1001 maxx, unprivileged), mount=/
  $ vmstat -m | grep -i prop | sort > /tmp/m0
  $ /tmp/vq_leak_loop / 1000
  did 1000 vquotactl(get usage all) on /, 0 errors
  $ vmstat -m | grep -i prop | sort > /tmp/m1
  $ /tmp/vq_leak_loop / 1000
  did 1000 vquotactl(get usage all) on /, 0 errors
  $ vmstat -m | grep -i prop | sort > /tmp/m2

==t0==
           proparay       9   1.69K       0    390M        9
           propdict     178   33.4K       0    390M      178
           propnmbr     376   20.6K       0    390M      376
           propstng     323   12.6K       0    390M      323
         prop_array       9   1.12K       0    390M        9
        prop_string     319   2.71K       0    390M      387
    prop_dictionary     170   42.5K       0    390M      196
==t1==  (after 1000 unprivileged calls)
           proparay    1009    189K       0    390M     1009
           propdict   3.10K    596K       0    390M    3.10K
           propnmbr     376   20.6K       0    390M      376
           propstng   2.27K   90.7K       0    390M    2.27K
         prop_array    1009    126K       0    390M     1009
        prop_string    2.26K   26.1K       0    390M    2.33K
    prop_dictionary   3.10K    792K       0    390M    3.12K
==t2==  (after 2000 unprivileged calls)
           proparay   1.96K    377K       0    390M    1.96K
           propdict   6.03K   1.13M       0    390M    6.03K
           propnmbr     376   20.6K       0    390M      376
           propstng   4.22K    169K       0    390M    4.22K
         prop_array   1.96K    251K       0    390M    1.96K
        prop_string   4.22K   49.6K       0    390M    4.28K
    prop_dictionary   6.03K   1.51M       0    390M    6.05K

DELTAS per 1000 calls: propdict +2920, prop_dictionary +2930, proparay +951,
prop_array +951, propstng +1950, prop_string +1960.
=> ~1.6-1.9 KB live kernel heap leaked PER UNPRIVILEGED SYSCALL, linear, unreclaimable.
(vm.kmem_size = 390M; exhaustion after ~250k calls = minutes of runtime)

Cross-check with base-system tooling as uid 1001:
  $ vquota show /
  total: 0
(one vquotactl round trip per invocation; same leak path)