Initial commit — leak-hunt project complete

Five bugs identified and patched in retail Asheron's Call client:
- v3b: palette refcount over-increment (3-byte NOP at two sites)
- v5: RenderSurface PurgeResource no-op stub (vtable slot 2 thunk)
- v11: two dangling-pointer crash guards (NULL-check + reorder)
- v14: CEnvCell::Destroy ClipPlaneList leak (18-byte JMP to cleanup thunk)
- v22: unpacker stale-pointer SEH guard (whole-function __try/__except)

All five ship in leakfix.dll (117 KB, SHA d282f23c…) which is loaded
by acclient.exe at process start via PE import table patching by
tools/install_leakfix.py.

Controlled 15-client fleet soak: unpatched control died at 26h with
palette exhaustion; all 14 patched clients survived past that point
and reached ≥5-day uptime.

Residual ~15 MB/h growth traced to d3d9.dll's internal slab allocator
(260KB surface backing buffers retained after Release). See REPORT.md
§10 for the full investigation; conclusion is that it's unfixable from
outside d3d9.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

tools/count_physobj_partarray.py

@@ -0,0 +1,100 @@
+"""Count CPhysicsObj vs CPhysicsPart vs Position in given PIDs."""
+import ctypes, ctypes.wintypes as wt, struct, sys, subprocess
+from collections import Counter
+
+POSITION_VT = 0x00797910
+CPHYSICSOBJ_VT = 0x007c78e0       # EoR CPhysicsObj vtable
+# CPhysicsPart doesn't have its own vtable (no virtual methods); we
+# detect via its embedded Position pair at offsets 48 + 120.
+# The signature is: two Position vts 72 bytes apart, with 0x3f800000 at -4.
+
+PROCESS_VM_READ = 0x10
+PROCESS_QUERY_INFORMATION = 0x400
+class MBI(ctypes.Structure):
+    _fields_ = [('BaseAddress', ctypes.c_void_p),
+                ('AllocationBase', ctypes.c_void_p),
+                ('AllocationProtect', wt.DWORD),
+                ('PartitionId', wt.WORD),
+                ('RegionSize', ctypes.c_size_t),
+                ('State', wt.DWORD),
+                ('Protect', wt.DWORD),
+                ('Type', wt.DWORD)]
+
+k = ctypes.windll.kernel32
+k.OpenProcess.argtypes = [wt.DWORD, wt.BOOL, wt.DWORD]; k.OpenProcess.restype = wt.HANDLE
+k.CloseHandle.argtypes = [wt.HANDLE]; k.CloseHandle.restype = wt.BOOL
+k.ReadProcessMemory.argtypes = [wt.HANDLE, wt.LPCVOID, wt.LPVOID, ctypes.c_size_t,
+                                ctypes.POINTER(ctypes.c_size_t)]
+k.ReadProcessMemory.restype = wt.BOOL
+k.VirtualQueryEx.argtypes = [wt.HANDLE, ctypes.c_void_p, ctypes.POINTER(MBI), ctypes.c_size_t]
+k.VirtualQueryEx.restype = ctypes.c_size_t
+
+
+def scan_pid(pid):
+    h = k.OpenProcess(PROCESS_VM_READ | PROCESS_QUERY_INFORMATION, False, pid)
+    if not h:
+        return None
+    positions = 0
+    physobjs = 0
+    parts_two_pos = 0   # length-2 Position arrays = CPhysicsPart signature
+    parts_with_scale_1 = 0  # with 0x3f800000 in scale-z slot
+    mbi = MBI(); addr = 0
+    while k.VirtualQueryEx(h, addr, ctypes.byref(mbi), ctypes.sizeof(mbi)):
+        pr = mbi.Protect & 0xff
+        if mbi.State == 0x1000 and mbi.Type == 0x20000 and pr in (0x04, 0x40):
+            buf = (ctypes.c_ubyte * mbi.RegionSize)()
+            sz = ctypes.c_size_t(0)
+            if k.ReadProcessMemory(h, mbi.BaseAddress, buf, mbi.RegionSize, ctypes.byref(sz)):
+                data = bytes(buf[:sz.value])
+                end = (len(data) // 4) * 4
+                pos_offs = set()
+                for off in range(0, end, 4):
+                    v = struct.unpack_from("<I", data, off)[0]
+                    if v == POSITION_VT:
+                        positions += 1
+                        pos_offs.add(off)
+                    elif v == CPHYSICSOBJ_VT:
+                        physobjs += 1
+                # CPhysicsPart: a position at offset N AND another at N+72 AND off>=48
+                for off in pos_offs:
+                    if (off + 72) in pos_offs and (off - 72) not in pos_offs:
+                        # this is the array head — is this CPhysicsPart?
+                        # check -4 byte = scale-z float
+                        if off >= 4:
+                            m4 = struct.unpack_from("<I", data, off - 4)[0]
+                            parts_two_pos += 1
+                            if m4 == 0x3f800000:  # 1.0f
+                                parts_with_scale_1 += 1
+        addr = (mbi.BaseAddress or 0) + mbi.RegionSize
+        if addr >= 0x80000000:
+            break
+    k.CloseHandle(h)
+    return positions, physobjs, parts_two_pos, parts_with_scale_1
+
+
+# Gather PIDs + titles
+out = subprocess.check_output(
+    ["powershell.exe", "-NoProfile", "-Command",
+     "Get-Process acclient -EA SilentlyContinue | "
+     "ForEach-Object { \"$($_.Id)|$($_.MainWindowTitle)\" }"],
+    text=True).strip()
+pids_with_titles = []
+for ln in out.splitlines():
+    if "|" not in ln: continue
+    a,b = ln.split("|",1)
+    try:
+        pids_with_titles.append((int(a), b))
+    except ValueError: pass
+
+if len(sys.argv) > 1:
+    want = set(int(p) for p in sys.argv[1:])
+    pids_with_titles = [(p,t) for (p,t) in pids_with_titles if p in want]
+
+print(f"{'pid':>6} {'positions':>10} {'physobjs':>9} {'parts(2pos)':>12} {'parts(scale1)':>14}  title")
+for pid, title in pids_with_titles:
+    res = scan_pid(pid)
+    if res is None:
+        print(f"{pid:>6}  NOACCESS")
+    else:
+        positions, physobjs, parts, parts_s1 = res
+        print(f"{pid:>6} {positions:>10} {physobjs:>9} {parts:>12} {parts_s1:>14}  {title}")