DF-5686 BASELINE (vulnerable kernel #0) — as root, 500 UDEVPROP getdevs ioctls
$ /tmp/udev_getdevs_leak /dev/udev 500
did 500 UDEVPROP getdevs ioctls on /dev/udev

==before==
           proparay   1.97K    378K       0    390M    1.97K
         prop_array   1.96K    251K       0    390M    1.96K
==after==
           proparay   2.46K    472K       0    390M    2.46K
         prop_array   2.45K    876K       0    390M    6.85K

=> +490 arrays InUse, +625KB per 500 ioctls (~1.3KB per ioctl), linear, unreclaimable.
(each call also takes +1 ref on every cdev si_dict, pinning them forever)
Idle drift from devd observed separately: prop_array 1 -> 9 over ~10 min with no PoC.