Initial commit — leak-hunt project complete

Five bugs identified and patched in retail Asheron's Call client:
- v3b: palette refcount over-increment (3-byte NOP at two sites)
- v5: RenderSurface PurgeResource no-op stub (vtable slot 2 thunk)
- v11: two dangling-pointer crash guards (NULL-check + reorder)
- v14: CEnvCell::Destroy ClipPlaneList leak (18-byte JMP to cleanup thunk)
- v22: unpacker stale-pointer SEH guard (whole-function __try/__except)

All five ship in leakfix.dll (117 KB, SHA d282f23c…) which is loaded
by acclient.exe at process start via PE import table patching by
tools/install_leakfix.py.

Controlled 15-client fleet soak: unpatched control died at 26h with
palette exhaustion; all 14 patched clients survived past that point
and reached ≥5-day uptime.

Residual ~15 MB/h growth traced to d3d9.dll's internal slab allocator
(260KB surface backing buffers retained after Release). See REPORT.md
§10 for the full investigation; conclusion is that it's unfixable from
outside d3d9.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

tools/find_subclasses.py

@@ -0,0 +1,78 @@
+"""find_subclasses.py <dump.dmp> <parent_vtable> <noop_addr>
+
+Find vtables that look like subclasses of a parent class (share parent's
+slot 1 = CopyInto address, indicating inheritance not overridden).
+For each such vtable, report slot 2 — if it equals noop_addr, the
+subclass inherits the no-op stub (= leak source).
+
+Used to find GraphicsResource subclasses that inherit the no-op
+PurgeResource and therefore leak forever.
+"""
+import struct, sys
+from minidump.minidumpfile import MinidumpFile
+
+
+def _ei(v):
+    if v is None: return 0
+    if hasattr(v, 'value'): return int(v.value)
+    return int(v)
+
+
+def main():
+    md = MinidumpFile.parse(sys.argv[1])
+    parent_vtable = int(sys.argv[2], 0)
+    noop_addr = int(sys.argv[3], 0)
+
+    reader = md.get_reader().get_buffered_reader()
+
+    # Read parent's slot 1 - that's the "shared" value to look for
+    reader.move(parent_vtable + 4)
+    parent_slot1 = struct.unpack("<I", reader.read(4))[0]
+    print(f"Parent vtable: 0x{parent_vtable:08x}")
+    print(f"Parent slot 1 (CopyInto-like): 0x{parent_slot1:08x}")
+    print(f"No-op stub: 0x{noop_addr:08x}")
+    print()
+
+    # Image regions to scan (only image-typed RW)
+    image_ranges = []
+    for r in md.memory_info.infos:
+        st, ty, pr = _ei(r.State), _ei(r.Type), _ei(r.Protect) & 0xff
+        if st == 0x1000 and ty == 0x1000000 and pr in (0x02, 0x04, 0x40):
+            image_ranges.append((r.BaseAddress, r.RegionSize))
+
+    print(f"scanning {len(image_ranges)} image regions...")
+
+    found = []  # (vtable_addr, slot0, slot2, slot3)
+    for base, size in image_ranges:
+        try:
+            reader.move(base)
+            buf = reader.read(size)
+        except Exception:
+            continue
+        if not buf: continue
+        end = (len(buf) // 4) * 4
+        for off in range(0, end - 16, 4):
+            slot1 = struct.unpack_from("<I", buf, off + 4)[0]
+            if slot1 != parent_slot1:
+                continue
+            slot0 = struct.unpack_from("<I", buf, off)[0]
+            slot2 = struct.unpack_from("<I", buf, off + 8)[0]
+            slot3 = struct.unpack_from("<I", buf, off + 12)[0]
+            # Sanity: slot 0 (dtor) should be a code pointer in image
+            if slot0 < 0x00400000 or slot0 > 0x10000000:
+                continue
+            # Skip parent itself
+            if base + off == parent_vtable:
+                continue
+            found.append((base + off, slot0, slot2, slot3))
+
+    print(f"candidate subclass vtables: {len(found)}")
+    print()
+    print(f"{'vtable':<12} {'slot0 dtor':<12} {'slot2 Purge':<12} {'slot3 Restore':<12}  inherits_noop?")
+    for vt, s0, s2, s3 in found:
+        marker = "*** LEAKS — inherits no-op PurgeResource ***" if s2 == noop_addr else ""
+        print(f"0x{vt:08x}   0x{s0:08x}   0x{s2:08x}   0x{s3:08x}  {marker}")
+
+
+if __name__ == "__main__":
+    main()