Initial commit — leak-hunt project complete

Five bugs identified and patched in retail Asheron's Call client:
- v3b: palette refcount over-increment (3-byte NOP at two sites)
- v5: RenderSurface PurgeResource no-op stub (vtable slot 2 thunk)
- v11: two dangling-pointer crash guards (NULL-check + reorder)
- v14: CEnvCell::Destroy ClipPlaneList leak (18-byte JMP to cleanup thunk)
- v22: unpacker stale-pointer SEH guard (whole-function __try/__except)

All five ship in leakfix.dll (117 KB, SHA d282f23c…) which is loaded
by acclient.exe at process start via PE import table patching by
tools/install_leakfix.py.

Controlled 15-client fleet soak: unpatched control died at 26h with
palette exhaustion; all 14 patched clients survived past that point
and reached ≥5-day uptime.

Residual ~15 MB/h growth traced to d3d9.dll's internal slab allocator
(260KB surface backing buffers retained after Release). See REPORT.md
§10 for the full investigation; conclusion is that it's unfixable from
outside d3d9.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

tools/dump_cgfxobj.py

@@ -0,0 +1,81 @@
+"""dump_cgfxobj.py <pid>
+
+Enumerate CGfxObj instances (vtable 0x007ca418) in a live process and
+classify by:
+  - refcount (+0x24): how many references
+  - m_pMaintainer (+0x20): NULL = uncached, non-NULL = DBOCache-managed
+  - constructed_mesh (+0x6c): mesh holder
+"""
+import ctypes, ctypes.wintypes as wt, struct, sys
+from collections import Counter
+
+VTABLE = 0x007ca418
+PROCESS_VM_READ=0x10; PROCESS_QUERY_INFORMATION=0x400
+MEM_COMMIT=0x1000; MEM_PRIVATE=0x20000
+
+class MBI(ctypes.Structure):
+    _fields_ = [('BaseAddress',ctypes.c_void_p),('AllocationBase',ctypes.c_void_p),
+                ('AllocationProtect',wt.DWORD),('PartitionId',wt.WORD),('RegionSize',ctypes.c_size_t),
+                ('State',wt.DWORD),('Protect',wt.DWORD),('Type',wt.DWORD)]
+k = ctypes.windll.kernel32
+k.OpenProcess.argtypes=[wt.DWORD,wt.BOOL,wt.DWORD]; k.OpenProcess.restype=wt.HANDLE
+k.ReadProcessMemory.argtypes=[wt.HANDLE,wt.LPCVOID,wt.LPVOID,ctypes.c_size_t,ctypes.POINTER(ctypes.c_size_t)]
+k.ReadProcessMemory.restype=wt.BOOL
+k.VirtualQueryEx.argtypes=[wt.HANDLE,ctypes.c_void_p,ctypes.POINTER(MBI),ctypes.c_size_t]
+k.VirtualQueryEx.restype=ctypes.c_size_t
+
+pid = int(sys.argv[1])
+h = k.OpenProcess(PROCESS_VM_READ|PROCESS_QUERY_INFORMATION, False, pid)
+if not h:
+    print('open fail'); sys.exit(1)
+
+instances = []
+mbi=MBI(); addr=0
+while k.VirtualQueryEx(h, addr, ctypes.byref(mbi), ctypes.sizeof(mbi)):
+    if mbi.State==MEM_COMMIT and mbi.Type==MEM_PRIVATE and (mbi.Protect&0xff) in (0x04,0x40):
+        buf=(ctypes.c_ubyte*mbi.RegionSize)(); sz=ctypes.c_size_t(0)
+        if k.ReadProcessMemory(h, mbi.BaseAddress, buf, mbi.RegionSize, ctypes.byref(sz)):
+            data=bytes(buf[:sz.value]); end=(len(data)//4)*4
+            for off in range(0, end-0x80, 4):
+                if struct.unpack_from('<I', data, off)[0] == VTABLE:
+                    obj_addr = mbi.BaseAddress + off
+                    refcount = struct.unpack_from('<I', data, off + 0x24)[0]
+                    maintainer = struct.unpack_from('<I', data, off + 0x20)[0]
+                    mesh = struct.unpack_from('<I', data, off + 0x6c)[0]
+                    dataid = struct.unpack_from('<I', data, off + 0x28)[0]
+                    instances.append((obj_addr, refcount, maintainer, mesh, dataid))
+    addr=(mbi.BaseAddress or 0)+mbi.RegionSize
+    if addr>=0x80000000: break
+
+print(f'PID {pid}: {len(instances)} CGfxObj instances')
+
+# Buckets
+maint_null_mesh_null   = 0
+maint_null_mesh_set    = 0
+maint_set_mesh_null    = 0
+maint_set_mesh_set     = 0
+rc_hist = Counter()
+for addr, rc, m, mesh, did in instances:
+    rc_hist[min(rc, 100)] += 1
+    if m == 0 and mesh == 0: maint_null_mesh_null += 1
+    elif m == 0 and mesh != 0: maint_null_mesh_set += 1
+    elif m != 0 and mesh == 0: maint_set_mesh_null += 1
+    else: maint_set_mesh_set += 1
+
+print(f'Quadrants (m_pMaintainer, constructed_mesh):')
+print(f'  NULL/NULL: {maint_null_mesh_null}')
+print(f'  NULL/SET:  {maint_null_mesh_set}  <- ORPHAN MESHES (potential leak)')
+print(f'  SET/NULL:  {maint_set_mesh_null}')
+print(f'  SET/SET:   {maint_set_mesh_set}   <- cached with mesh (normal)')
+
+print('refcount histogram (top 8):')
+for rc, n in rc_hist.most_common(8):
+    print(f'  rc={rc}: {n}')
+
+# Show 5 examples of orphan
+print('Examples of NULL/SET orphans:')
+ex_count = 0
+for addr, rc, m, mesh, did in instances:
+    if m == 0 and mesh != 0 and ex_count < 5:
+        print(f'  obj 0x{addr:08x}  rc={rc}  mesh=0x{mesh:08x}  DataID=0x{did:08x}')
+        ex_count += 1