Initial commit — leak-hunt project complete

Five bugs identified and patched in retail Asheron's Call client:
- v3b: palette refcount over-increment (3-byte NOP at two sites)
- v5: RenderSurface PurgeResource no-op stub (vtable slot 2 thunk)
- v11: two dangling-pointer crash guards (NULL-check + reorder)
- v14: CEnvCell::Destroy ClipPlaneList leak (18-byte JMP to cleanup thunk)
- v22: unpacker stale-pointer SEH guard (whole-function __try/__except)

All five ship in leakfix.dll (117 KB, SHA d282f23c…) which is loaded
by acclient.exe at process start via PE import table patching by
tools/install_leakfix.py.

Controlled 15-client fleet soak: unpatched control died at 26h with
palette exhaustion; all 14 patched clients survived past that point
and reached ≥5-day uptime.

Residual ~15 MB/h growth traced to d3d9.dll's internal slab allocator
(260KB surface backing buffers retained after Release). See REPORT.md
§10 for the full investigation; conclusion is that it's unfixable from
outside d3d9.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

tools/probe_gmui_size.py

@@ -0,0 +1,74 @@
+"""probe_gmui_size.py <dump.dmp>
+
+Measure spacing between adjacent gm*UI instances in the same region
+to derive a real per-instance allocation size.
+"""
+import struct, sys
+from minidump.minidumpfile import MinidumpFile
+from collections import Counter
+
+
+GM_NOTICE_VT = 0x007ccb60
+GM_NOTICE_OFFSET = 0x5f8
+
+
+def _ei(v):
+    if v is None: return 0
+    if hasattr(v, 'value'): return int(v.value)
+    return int(v)
+
+
+md = MinidumpFile.parse(sys.argv[1])
+reader = md.get_reader().get_buffered_reader()
+scan = []
+for r in md.memory_info.infos:
+    st, ty, pr = _ei(r.State), _ei(r.Type), _ei(r.Protect) & 0xff
+    if st != 0x1000 or ty == 0x1000000 or pr not in (0x04, 0x40): continue
+    scan.append((r.BaseAddress, r.RegionSize))
+
+# Find outer-object addresses
+outers = []
+for base, size in scan:
+    try:
+        reader.move(base); buf = reader.read(size)
+    except Exception:
+        continue
+    if not buf: continue
+    end = (len(buf) // 4) * 4
+    for off in range(0, end - 4, 4):
+        if struct.unpack_from("<I", buf, off)[0] != GM_NOTICE_VT: continue
+        outer = (base + off) - GM_NOTICE_OFFSET
+        # Read outer vt
+        rel = off - GM_NOTICE_OFFSET
+        if rel < 0:
+            # outer is in previous region; skip
+            continue
+        outer_vt = struct.unpack_from("<I", buf, rel)[0]
+        if outer_vt == 0x007c0498:   # primary gm*UI base vt
+            outers.append(outer)
+
+outers.sort()
+print(f"gm*UI outers (vt 0x007c0498): {len(outers)}")
+
+# Compute deltas between consecutive outers
+deltas = Counter()
+for i in range(1, len(outers)):
+    d = outers[i] - outers[i-1]
+    if d < 0x4000:   # only intra-allocation neighbors
+        deltas[d] += 1
+
+print("top inter-instance deltas (bytes between adjacent outers in same region):")
+for d, n in deltas.most_common(15):
+    print(f"  0x{d:04x} ({d:>6})  x{n}")
+
+# Also probe MEM_PRIVATE region sizes that *contain* gm*UI outers
+sizes = Counter()
+for o in outers:
+    for base, size in scan:
+        if base <= o < base + size:
+            sizes[size] += 1
+            break
+print()
+print("region sizes containing gm*UI outers:")
+for s, n in sizes.most_common(15):
+    print(f"  size={s:>9} ({s/1024:>6.1f}KB)  x{n}")