Initial commit — leak-hunt project complete

Five bugs identified and patched in retail Asheron's Call client:
- v3b: palette refcount over-increment (3-byte NOP at two sites)
- v5: RenderSurface PurgeResource no-op stub (vtable slot 2 thunk)
- v11: two dangling-pointer crash guards (NULL-check + reorder)
- v14: CEnvCell::Destroy ClipPlaneList leak (18-byte JMP to cleanup thunk)
- v22: unpacker stale-pointer SEH guard (whole-function __try/__except)

All five ship in leakfix.dll (117 KB, SHA d282f23c…) which is loaded
by acclient.exe at process start via PE import table patching by
tools/install_leakfix.py.

Controlled 15-client fleet soak: unpatched control died at 26h with
palette exhaustion; all 14 patched clients survived past that point
and reached ≥5-day uptime.

Residual ~15 MB/h growth traced to d3d9.dll's internal slab allocator
(260KB surface backing buffers retained after Release). See REPORT.md
§10 for the full investigation; conclusion is that it's unfixable from
outside d3d9.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

tools/probe_imgtex.py

@@ -0,0 +1,113 @@
+"""probe_imgtex.py <pid>
+Walk s_Resources, find ImgTex entries (vfptr=0x007cab04 — GR-view).
+Split live vs lost, sample which fields are still non-NULL when "lost".
+
+ImgTex members (primary-relative):
+  +0x58 m_SourceLevels.m_data (SmartArray<DataID>)  => entry+0x28 (heap buffer)
+  +0x5c m_SourceLevels.m_sizeAndDeallocate          => entry+0x2c
+  +0x60 m_SourceLevels.m_num                        => entry+0x30
+  +0x64 m_pImageData (RenderSurface*)               => entry+0x34 (PurgeResource releases)
+  +0x68 m_pPalette (Palette*)                       => entry+0x38 (PurgeResource MISSES)
+  +0x6c m_cPitch
+  +0x70 m_TextureCode (8 bytes)
+  +0x78 m_pD3DTexture                               => entry+0x48 (PurgeResource releases)
+  +0x7c m_pRenderTexture                            => entry+0x4c (PurgeResource releases)
+  +0x80 m_pSystemMemTexture                         => entry+0x50 (PurgeResource MISSES)
+"""
+import ctypes, ctypes.wintypes as wt, sys, struct
+
+PROCESS_VM_READ = 0x10
+PROCESS_QUERY_INFORMATION = 0x400
+k = ctypes.windll.kernel32
+k.OpenProcess.argtypes = [wt.DWORD, wt.BOOL, wt.DWORD]; k.OpenProcess.restype = wt.HANDLE
+k.ReadProcessMemory.argtypes = [wt.HANDLE, wt.LPCVOID, wt.LPVOID, ctypes.c_size_t, ctypes.POINTER(ctypes.c_size_t)]
+k.ReadProcessMemory.restype = wt.BOOL
+
+S_RESOURCES_M_DATA = 0x008398C4
+S_RESOURCES_M_NUM  = 0x008398CC
+IMGTEX_GR_VTABLE   = 0x007cab04
+
+def rd_u32(h, va):
+    buf = (ctypes.c_ubyte * 4)(); sz = ctypes.c_size_t(0)
+    if not k.ReadProcessMemory(h, va, buf, 4, ctypes.byref(sz)) or sz.value != 4: return None
+    return struct.unpack('<I', bytes(buf))[0]
+
+pid = int(sys.argv[1])
+h = k.OpenProcess(PROCESS_VM_READ | PROCESS_QUERY_INFORMATION, False, pid)
+if not h: print(f"OpenProcess err={ctypes.get_last_error()}"); sys.exit(2)
+
+m_data = rd_u32(h, S_RESOURCES_M_DATA)
+m_num  = rd_u32(h, S_RESOURCES_M_NUM)
+print(f"pid {pid}: s_Resources m_data=0x{m_data:08x} m_num={m_num}")
+
+total = 0; lost = 0; live = 0
+# Per-field non-NULL counters (lost only — what's leaked)
+L_sl_data = L_imgdata = L_pal = L_d3dtex = L_rt = L_sysmem = 0
+V_sl_data = V_imgdata = V_pal = V_d3dtex = V_rt = V_sysmem = 0
+samples_lost = []
+samples_live = []
+
+for i in range(min(m_num, 200000)):
+    entry = rd_u32(h, m_data + i * 4)
+    if not entry: continue
+    vt = rd_u32(h, entry)
+    if vt != IMGTEX_GR_VTABLE: continue
+    total += 1
+    bIsLost_word = rd_u32(h, entry + 8)
+    is_lost = (bIsLost_word & 0xFF) != 0
+    sl_data = rd_u32(h, entry + 0x28)
+    sl_size = rd_u32(h, entry + 0x2c)
+    imgdata = rd_u32(h, entry + 0x34)
+    pal     = rd_u32(h, entry + 0x38)
+    d3dtex  = rd_u32(h, entry + 0x48)
+    rt      = rd_u32(h, entry + 0x4c)
+    sysmem  = rd_u32(h, entry + 0x50)
+    if any(x is None for x in (sl_data, imgdata, pal, d3dtex, rt, sysmem)): continue
+    if is_lost:
+        lost += 1
+        if sl_data != 0: L_sl_data += 1
+        if imgdata != 0: L_imgdata += 1
+        if pal     != 0: L_pal     += 1
+        if d3dtex  != 0: L_d3dtex  += 1
+        if rt      != 0: L_rt      += 1
+        if sysmem  != 0: L_sysmem  += 1
+        if (sl_data | imgdata | pal | d3dtex | rt | sysmem) and len(samples_lost) < 5:
+            samples_lost.append((entry, sl_data, sl_size, imgdata, pal, d3dtex, rt, sysmem))
+    else:
+        live += 1
+        if sl_data != 0: V_sl_data += 1
+        if imgdata != 0: V_imgdata += 1
+        if pal     != 0: V_pal     += 1
+        if d3dtex  != 0: V_d3dtex  += 1
+        if rt      != 0: V_rt      += 1
+        if sysmem  != 0: V_sysmem  += 1
+        if len(samples_live) < 3:
+            samples_live.append((entry, sl_data, sl_size, imgdata, pal, d3dtex, rt, sysmem))
+
+print(f"ImgTex entries: total={total} live={live} lost={lost}")
+def report(prefix, n, vals):
+    print(f"  {prefix}:")
+    for label, c in vals:
+        print(f"    {label:24s} non-NULL  {c}/{n} ({100*c//max(n,1)}%)")
+report("LOST (potential leaks)", lost, [
+    ("m_SourceLevels.m_data", L_sl_data),
+    ("m_pImageData (released)", L_imgdata),
+    ("m_pPalette (MISSED?)",   L_pal),
+    ("m_pD3DTexture (rel'd)",  L_d3dtex),
+    ("m_pRenderTexture (rel'd)",L_rt),
+    ("m_pSysMemTexture (MISS?)",L_sysmem),
+])
+report("LIVE", live, [
+    ("m_SourceLevels.m_data", V_sl_data),
+    ("m_pImageData",          V_imgdata),
+    ("m_pPalette",            V_pal),
+    ("m_pD3DTexture",         V_d3dtex),
+    ("m_pRenderTexture",      V_rt),
+    ("m_pSysMemTexture",      V_sysmem),
+])
+print(f"  LOST samples (entry, sl_data, sl_size, imgdata, pal, d3dtex, rt, sysmem):")
+for s in samples_lost:
+    print(f"    0x{s[0]:08x} sl=0x{s[1]:08x}|{s[2]:x} img=0x{s[3]:08x} pal=0x{s[4]:08x} d3d=0x{s[5]:08x} rt=0x{s[6]:08x} sm=0x{s[7]:08x}")
+print(f"  LIVE samples:")
+for s in samples_live:
+    print(f"    0x{s[0]:08x} sl=0x{s[1]:08x}|{s[2]:x} img=0x{s[3]:08x} pal=0x{s[4]:08x} d3d=0x{s[5]:08x} rt=0x{s[6]:08x} sm=0x{s[7]:08x}")