Initial commit — leak-hunt project complete

Five bugs identified and patched in retail Asheron's Call client:
- v3b: palette refcount over-increment (3-byte NOP at two sites)
- v5: RenderSurface PurgeResource no-op stub (vtable slot 2 thunk)
- v11: two dangling-pointer crash guards (NULL-check + reorder)
- v14: CEnvCell::Destroy ClipPlaneList leak (18-byte JMP to cleanup thunk)
- v22: unpacker stale-pointer SEH guard (whole-function __try/__except)

All five ship in leakfix.dll (117 KB, SHA d282f23c…) which is loaded
by acclient.exe at process start via PE import table patching by
tools/install_leakfix.py.

Controlled 15-client fleet soak: unpatched control died at 26h with
palette exhaustion; all 14 patched clients survived past that point
and reached ≥5-day uptime.

Residual ~15 MB/h growth traced to d3d9.dll's internal slab allocator
(260KB surface backing buffers retained after Release). See REPORT.md
§10 for the full investigation; conclusion is that it's unfixable from
outside d3d9.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

tools/trace_mesh_holder.py

@@ -0,0 +1,96 @@
+"""trace_mesh_holder.py <pid>
+
+Find ONE D3DXMesh instance, locate all pointers to it, and dump the
+surrounding bytes for each pointer location so we can identify the
+container by direct inspection (not heuristic vtable-walking).
+"""
+import ctypes, ctypes.wintypes as wt, struct, sys
+from collections import Counter
+
+VTABLE = 0x007ed3b0
+PROCESS_VM_READ=0x10; PROCESS_QUERY_INFORMATION=0x400
+MEM_COMMIT=0x1000; MEM_PRIVATE=0x20000; MEM_IMAGE=0x1000000
+
+class MBI(ctypes.Structure):
+    _fields_ = [('BaseAddress',ctypes.c_void_p),('AllocationBase',ctypes.c_void_p),
+                ('AllocationProtect',wt.DWORD),('PartitionId',wt.WORD),('RegionSize',ctypes.c_size_t),
+                ('State',wt.DWORD),('Protect',wt.DWORD),('Type',wt.DWORD)]
+k = ctypes.windll.kernel32
+k.OpenProcess.argtypes=[wt.DWORD,wt.BOOL,wt.DWORD]; k.OpenProcess.restype=wt.HANDLE
+k.ReadProcessMemory.argtypes=[wt.HANDLE,wt.LPCVOID,wt.LPVOID,ctypes.c_size_t,ctypes.POINTER(ctypes.c_size_t)]
+k.ReadProcessMemory.restype=wt.BOOL
+k.VirtualQueryEx.argtypes=[wt.HANDLE,ctypes.c_void_p,ctypes.POINTER(MBI),ctypes.c_size_t]
+k.VirtualQueryEx.restype=ctypes.c_size_t
+
+pid = int(sys.argv[1])
+h = k.OpenProcess(PROCESS_VM_READ|PROCESS_QUERY_INFORMATION, False, pid)
+if not h: sys.exit('open fail')
+
+# Enum all regions
+rw_regions = []
+image_ranges = []
+mbi=MBI(); addr=0
+while k.VirtualQueryEx(h, addr, ctypes.byref(mbi), ctypes.sizeof(mbi)):
+    if mbi.State==MEM_COMMIT and (mbi.Protect&0xff) != 0x01:
+        if mbi.Type==MEM_IMAGE:
+            image_ranges.append((mbi.BaseAddress, mbi.BaseAddress+mbi.RegionSize))
+        elif mbi.Type==MEM_PRIVATE and (mbi.Protect&0xff) in (0x04, 0x40):
+            buf=(ctypes.c_ubyte*mbi.RegionSize)(); sz=ctypes.c_size_t(0)
+            if k.ReadProcessMemory(h, mbi.BaseAddress, buf, mbi.RegionSize, ctypes.byref(sz)):
+                rw_regions.append((mbi.BaseAddress, bytes(buf[:sz.value])))
+    addr=(mbi.BaseAddress or 0)+mbi.RegionSize
+    if addr>=0x80000000: break
+
+def is_image(p):
+    for lo, hi in image_ranges:
+        if lo <= p < hi: return True
+    return False
+
+# Find first D3DXMesh instance
+mesh_addrs = []
+for base, data in rw_regions:
+    end = (len(data)//4)*4
+    for off in range(0, end-4, 4):
+        if struct.unpack_from('<I', data, off)[0] == VTABLE:
+            mesh_addrs.append(base + off)
+print(f'total D3DXMesh instances: {len(mesh_addrs)}')
+
+# Pick an "orphan" mesh that isn't held by any CGfxObj.
+# CGfxObj vtable 0x007ca418 has constructed_mesh at +0x6c. The pointer at +0x6c is a MeshBuffer*.
+# So a mesh held by CGfxObj is reached as: cgfxobj+0x6c -> meshbuffer+0x00 -> mesh
+# Direct pointers to meshes (NOT through MeshBuffer) are the orphans.
+
+# First: find MeshBuffer addresses (every CGfxObj's +0x6c points to one)
+# We'll just find ALL pointers to mesh addresses and let user inspect.
+
+# Take first 10 mesh addresses and find all pointers to each
+mesh_addr_set = set(mesh_addrs)
+print(f'Analysing first 20 mesh instances and their referrers:')
+for mesh_addr in mesh_addrs[:20]:
+    refs = []
+    for base, data in rw_regions:
+        end = (len(data)//4)*4
+        for off in range(0, end-4, 4):
+            if struct.unpack_from('<I', data, off)[0] == mesh_addr:
+                ref_va = base + off
+                if ref_va in mesh_addr_set: continue  # skip self
+                refs.append((ref_va, base, data, off))
+    print(f'  mesh @ 0x{mesh_addr:08x}: {len(refs)} pointers to it')
+    for ref_va, rb, rd, ro in refs[:2]:
+        # Dump 0x40 bytes BEFORE and 0x10 after the reference
+        ctx_start = max(0, ro - 0x40)
+        ctx_end = min(len(rd), ro + 0x10)
+        ctx_bytes = rd[ctx_start:ctx_end]
+        hex_str = ' '.join(f'{b:02x}' for b in ctx_bytes)
+        # Locate any vtable-looking DWORD in the preceding 0x40 bytes
+        nearest_vt = None
+        nearest_vt_offset = None
+        for back in range(ro - 4, max(0, ro - 0x100) - 4, -4):
+            if back < 0: break
+            v = struct.unpack_from('<I', rd, back)[0]
+            if is_image(v) and v >= 0x00400000 and v < 0x01000000:
+                nearest_vt = v
+                nearest_vt_offset = ro - back
+                break
+        vt_str = f' nearest vtable 0x{nearest_vt:08x} at -0x{nearest_vt_offset:x}' if nearest_vt else ' no vtable in 0x100 lookback'
+        print(f'    ref@0x{ref_va:08x}:{vt_str}')