From 4d0ef195bc68e8c85ca9ccfd991be1dc616d79ee Mon Sep 17 00:00:00 2001
From: Robert Ream <154010+robertream@users.noreply.github.com>
Date: Sun, 21 Jun 2026 17:26:55 -0500
Subject: [PATCH] aarch64: Fix context refcount leak on SVC dispatch

`synchronous_handler` acquires a refcount but only releases it on the fault path, leaking one ref per syscall. Since syscall_handler takes its own refcount, we can safely release the initial refcount before syscall dispatch.
---
 src/aarch64/interrupt.c | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/src/aarch64/interrupt.c b/src/aarch64/interrupt.c
index ebfd518a1..60a848500 100644
--- a/src/aarch64/interrupt.c
+++ b/src/aarch64/interrupt.c
@@ -217,6 +217,10 @@ void synchronous_handler(void)
     int ec = field_from_u64(esr, ESR_EC);
     if (ec == ESR_EC_SVC_AARCH64 && (esr & ESR_IL) &&
         field_from_u64(esr, ESR_ISS_IMM16) == 0) {
+        /* The fault path releases the reserve above via the fault_handler
+           return; the SVC path dispatches into syscall handling (which takes
+           its own thread reference), so balance the reserve here. */
+        context_release_refcount(ctx);
         context ctx = ci->m.syscall_context;
         f[FRAME_VECTOR] = f[FRAME_X8];
         set_current_context(ci, ctx);