From 74ea7af2aeae8be201959771f56d384775b3ec12 Mon Sep 17 00:00:00 2001
From: rabbitstack <rabbitstack7@gmail.com>
Date: Thu, 5 Feb 2026 16:14:30 +0100
Subject: [PATCH] fix(event,processors): Prevent slice capacity leak

Hard free the event buffer to prevent slice leak when the
capacity grows and GC cannot reclaim the memory because
the buffer still references it.
---
 internal/etw/processors/fs_windows.go | 8 ++++++--
 pkg/event/stackwalk.go                | 8 ++++++--
 2 files changed, 12 insertions(+), 4 deletions(-)

diff --git a/internal/etw/processors/fs_windows.go b/internal/etw/processors/fs_windows.go
index 96a654a5b..4159afc49 100644
--- a/internal/etw/processors/fs_windows.go
+++ b/internal/etw/processors/fs_windows.go
@@ -372,13 +372,17 @@ func (f *fsProcessor) purge() {
 
 			// evict unmatched stack traces
 			for id, q := range f.buckets {
-				s := q[:0]
+				s := make([]*event.Event, 0, len(q))
 				for _, evt := range q {
 					if time.Since(evt.Timestamp) <= time.Second*30 {
 						s = append(s, evt)
 					}
 				}
-				f.buckets[id] = s
+				if len(s) == 0 {
+					delete(f.buckets, id)
+				} else {
+					f.buckets[id] = s
+				}
 			}
 
 			f.mu.Unlock()
diff --git a/pkg/event/stackwalk.go b/pkg/event/stackwalk.go
index d785c9cca..d916d4198 100644
--- a/pkg/event/stackwalk.go
+++ b/pkg/event/stackwalk.go
@@ -210,7 +210,7 @@ func (s *StackwalkDecorator) flush() []error {
 	errs := make([]error, 0)
 
 	for id, q := range s.buckets {
-		n := q[:0]
+		n := make([]*Event, 0, len(q))
 		for _, evt := range q {
 			if time.Since(evt.Timestamp) < maxQueueTTLPeriod {
 				n = append(n, evt)
@@ -230,7 +230,11 @@ func (s *StackwalkDecorator) flush() []error {
 			}
 			stackwalkFlushesEvents.Add(evt.Name, 1)
 		}
-		s.buckets[id] = n
+		if len(n) == 0 {
+			delete(s.buckets, id)
+		} else {
+			s.buckets[id] = n
+		}
 	}
 
 	return errs