Initial commit — leak-hunt project complete

Five bugs identified and patched in retail Asheron's Call client:
- v3b: palette refcount over-increment (3-byte NOP at two sites)
- v5: RenderSurface PurgeResource no-op stub (vtable slot 2 thunk)
- v11: two dangling-pointer crash guards (NULL-check + reorder)
- v14: CEnvCell::Destroy ClipPlaneList leak (18-byte JMP to cleanup thunk)
- v22: unpacker stale-pointer SEH guard (whole-function __try/__except)

All five ship in leakfix.dll (117 KB, SHA d282f23c…) which is loaded
by acclient.exe at process start via PE import table patching by
tools/install_leakfix.py.

Controlled 15-client fleet soak: unpatched control died at 26h with
palette exhaustion; all 14 patched clients survived past that point
and reached ≥5-day uptime.

Residual ~15 MB/h growth traced to d3d9.dll's internal slab allocator
(260KB surface backing buffers retained after Release). See REPORT.md
§10 for the full investigation; conclusion is that it's unfixable from
outside d3d9.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

tools/read_function_bytes.py

@@ -0,0 +1,41 @@
+"""
+read_function_bytes.py <pid> <addr_hex> [bytes]
+Reads N bytes from a remote process at a given address. Used to inspect what
+function actually lives at a vtable slot's target.
+"""
+import ctypes, ctypes.wintypes as wt, sys
+
+PROCESS_VM_READ           = 0x0010
+PROCESS_QUERY_INFORMATION = 0x0400
+
+k32 = ctypes.windll.kernel32
+OpenProcess = k32.OpenProcess
+OpenProcess.argtypes = [wt.DWORD, wt.BOOL, wt.DWORD]; OpenProcess.restype = wt.HANDLE
+CloseHandle = k32.CloseHandle
+CloseHandle.argtypes = [wt.HANDLE]; CloseHandle.restype = wt.BOOL
+ReadProcessMemory = k32.ReadProcessMemory
+ReadProcessMemory.argtypes = [wt.HANDLE, wt.LPCVOID, wt.LPVOID, ctypes.c_size_t,
+                              ctypes.POINTER(ctypes.c_size_t)]
+ReadProcessMemory.restype = wt.BOOL
+
+pid  = int(sys.argv[1])
+addr = int(sys.argv[2], 0)
+n    = int(sys.argv[3]) if len(sys.argv) > 3 else 64
+
+h = OpenProcess(PROCESS_VM_READ | PROCESS_QUERY_INFORMATION, False, pid)
+if not h:
+    print(f"OpenProcess failed: err={ctypes.get_last_error()}"); sys.exit(2)
+
+buf = (ctypes.c_ubyte * n)()
+sz  = ctypes.c_size_t(0)
+if not ReadProcessMemory(h, addr, buf, n, ctypes.byref(sz)):
+    print(f"ReadProcessMemory failed: err={ctypes.get_last_error()}"); CloseHandle(h); sys.exit(3)
+
+print(f"PID {pid}  addr 0x{addr:08x}  bytes read: {sz.value}")
+data = bytes(buf[:sz.value])
+for i in range(0, len(data), 16):
+    chunk = data[i:i+16]
+    hexs = " ".join(f"{b:02x}" for b in chunk)
+    asci = "".join(chr(b) if 32 <= b < 127 else "." for b in chunk)
+    print(f"  0x{addr+i:08x}  {hexs:<47}  {asci}")
+CloseHandle(h)