DF-5683 FIX VALIDATION (patched kernel #1: Sat Oct 10 00:36:54 UTC 2026, fix_combined.diff applied)
Driver: /tmp/vq_leak_loop as ROOT (passes the DF-5684 privilege gate added by the
combined fix, thereby exercising the identical object-lifetime path), mount=/

==before==
           proparay       1     192       0    390M        1
           propdict     150   28.1K       0    390M      150
           propnmbr     377   20.6K       0    390M      377
           propstng     314   12.3K       0    390M      314
         prop_array       0       0       0    390M        1
        prop_string     307   2.55K       0    390M      378
    prop_dictionary     143   35.8K       0    390M      178
  $ /tmp/vq_leak_loop / 2000
  did 2000 vquotactl(get usage all) on /, 0 errors
==after_2000_calls==
           proparay       2     384       0    390M        2
           propdict     152   28.5K       0    390M      152
           propnmbr     377   20.6K       0    390M      377
           propstng     315   12.3K       0    390M      315
         prop_array       0       0       0    390M    1.95K
        prop_string     307   2.55K       0    390M    4.28K
    prop_dictionary     143   35.8K       0    390M    6.03K

2000 calls -> +1 proparay, +2 propdict, +1 propstng (per-boot transients).
Baseline for the same 2000 calls: +5840 dicts / +1908 arrays / +3900 strings.
LEAK ELIMINATED. Unprivileged callers now get EPERM before any allocation
(see DF-5684 fix validation).