# DF-5727 — DDB `watch addr,size` (documented syntax) silently drops the size — always watches 4 bytes

**Severity: Low (DDB console is root-gated; mis-sized tripwire, compounds the
DF-5721 dead-instrument problem with a distinct argument-parsing root cause).**

## What breaks

`ddb(4)` documents `watch addr[,size]` ("The size argument defaults to 4"),
but `db_command()` (`db_command.c:386-396`) parses `,size` into the command's
`count` parameter, and `db_watchpoint_cmd()` (`db_watch.c:198-201`) ignores
`count` entirely and instead re-parses the token stream — which is already at
end-of-line, so `db_expression()` returns FALSE and the size silently defaults
to 4.  (Only the undocumented space form `watch addr size` reaches the size.)

`db_set_watchpoint()` then arms `loaddr..loaddr+4` instead of the requested
region — an operator watching an 8-byte field with the documented syntax
watches half of it, with no error.

## Live proof (stock kernel)

`baseline-up.serial.log` / `session1-smp.serial.log`:

```
db> watch ticks,8
db> show watches
 Map        Address  Size
*ffffffff8159eea0  ffffffff810529c8  4      <-- requested 8, got 4
db> dwatch ticks
db> watch ticks 8
db> show watches
 Map        Address  Size
*ffffffff8159eea0  ffffffff810529c8  8      <-- undocumented syntax works
```

## Fix

Honor the parser-provided `count` (`db_watch.c`), keep the legacy space form —
see `fix.diff`.  Validated on the patched kernel: `watch ticks,8` now shows
`Size 8`; `watch ticks` still defaults to 4.

## Reproduce

```
./serial_vm1.sh up && ./enter_ddb.sh
DF5725_SOCK=/tmp/opencode/df-5725-ser-up.sock ./drive_ddb.py \
   "watch ticks,8" 2 "show watches" 3 "dwatch ticks" 2 \
   "watch ticks 8" 2 "show watches" 3 "dwatch ticks" 2 "c" 8
```