Initial commit — leak-hunt project complete

Five bugs identified and patched in retail Asheron's Call client:
- v3b: palette refcount over-increment (3-byte NOP at two sites)
- v5: RenderSurface PurgeResource no-op stub (vtable slot 2 thunk)
- v11: two dangling-pointer crash guards (NULL-check + reorder)
- v14: CEnvCell::Destroy ClipPlaneList leak (18-byte JMP to cleanup thunk)
- v22: unpacker stale-pointer SEH guard (whole-function __try/__except)

All five ship in leakfix.dll (117 KB, SHA d282f23c…) which is loaded
by acclient.exe at process start via PE import table patching by
tools/install_leakfix.py.

Controlled 15-client fleet soak: unpatched control died at 26h with
palette exhaustion; all 14 patched clients survived past that point
and reached ≥5-day uptime.

Residual ~15 MB/h growth traced to d3d9.dll's internal slab allocator
(260KB surface backing buffers retained after Release). See REPORT.md
§10 for the full investigation; conclusion is that it's unfixable from
outside d3d9.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

tools/find_vtable_refs.py

@@ -0,0 +1,50 @@
+"""find_vtable_refs.py <dump.dmp> <addr_hex>
+Scan ALL committed memory (not just RW writable) for any DWORD == addr.
+Used to verify whether an alleged vtable address is referenced anywhere
+in the dump's process memory.
+"""
+import os, struct, sys
+from collections import Counter
+from minidump.minidumpfile import MinidumpFile
+
+def _ei(v):
+    if v is None: return 0
+    if hasattr(v, 'value'): return int(v.value)
+    return int(v)
+
+md = MinidumpFile.parse(sys.argv[1])
+target = int(sys.argv[2], 16)
+print(f"searching for 0x{target:08x} in dump {sys.argv[1]}")
+
+reader = md.get_reader().get_buffered_reader()
+
+# Scan everything committed
+hits = []
+total = 0
+for r in md.memory_info.infos:
+    st = _ei(r.State); ty = _ei(r.Type); pr = _ei(r.Protect) & 0xff
+    if st != 0x1000: continue   # not committed
+    if pr == 0x01:  continue    # no-access
+    try:
+        reader.move(r.BaseAddress)
+        buf = reader.read(r.RegionSize)
+    except Exception:
+        continue
+    if not buf: continue
+    total += len(buf)
+    end = (len(buf) // 4) * 4
+    for off in range(0, end, 4):
+        v = struct.unpack_from("<I", buf, off)[0]
+        if v == target:
+            type_name = {0x20000: "Private", 0x40000: "Mapped", 0x1000000: "Image"}.get(ty, hex(ty))
+            hits.append((r.BaseAddress + off, type_name))
+
+print(f"scanned {total/(1024*1024):.1f} MB")
+print(f"hits: {len(hits)}")
+# Histogram by region type
+hist = Counter(h[1] for h in hits)
+for t, c in hist.most_common():
+    print(f"  {t}: {c}")
+print("first 15 hits:")
+for addr, t in hits[:15]:
+    print(f"  0x{addr:08x}  ({t})")