feat(real-world-vfc-slice): add labeled OpenSSL/Firefox/Chromium/curl pair corpus

Harvest 176 isolated vuln-vs-fix functions (109 CVEs, 352 training rows)
into benchmarks/pairs/vfc with provenance and a JSONL training manifest.
Score the slice as an honesty dashboard (ousast pairs --slice vfc);
keep the pair gate on the local fixtures only.

benchmarks/pairs/vfc/openssl-cve-2024-4741-tls_free_buffers/fixed.c

@@ -0,0 +1,41 @@
+/* Provenance: openssl/openssl tls_free_buffers (fixed).
+ * repo: openssl/openssl
+ * commit: c88c3de51020c37e8706bf7a682a162593053aac
+ * parent: 17765d9cefed8b4ada6548719beb98e22672a9bd
+ * commit_url: https://github.com/openssl/openssl/commit/c88c3de51020c37e8706bf7a682a162593053aac
+ * cve: CVE-2024-4741
+ * license: Apache-2.0
+ * function: tls_free_buffers
+ * relpath: ssl/record/methods/tls_common.c
+ */
+
+int tls_free_buffers(OSSL_RECORD_LAYER *rl)
+{
+    if (rl->direction == OSSL_RECORD_DIRECTION_WRITE) {
+        if (rl->nextwbuf < rl->numwpipes) {
+            /*
+             * We may have pending data. If we've just got one empty buffer
+             * allocated then it has probably just been alloc'd via
+             * tls_alloc_buffers, and it is fine to free it. Otherwise this
+             * looks like real pending data and it is an error.
+             */
+            if (rl->nextwbuf != 0
+                    || rl->numwpipes != 1
+                    || TLS_BUFFER_get_left(&rl->wbuf[0]) != 0)
+                return 0;
+        }
+        tls_release_write_buffer(rl);
+        return 1;
+    }
+
+    /* Read direction */
+
+    /* If we have pending data to be read then fail */
+    if (rl->curr_rec < rl->num_recs
+            || rl->curr_rec != rl->num_released
+            || TLS_BUFFER_get_left(&rl->rbuf) != 0
+            || rl->rstate == SSL_ST_READ_BODY)
+        return 0;
+
+    return tls_release_read_buffer(rl);
+}