DF-0016 PATCHED-KERNEL RUN — single-fix DragonFly 6.5-DEVELOPMENT #1 (Thu Jul  2 19:25:22 UTC 2026)
kernel sha256: 0968423828d08aee0dad955f470218cda550801dcda17d620c048b9e566b46d4
fix applied: sys/kern/kern_kinfo.c — kp_paddr/kp_fd/kl_wchan/kp_ktaddr/kp_lwp.kl_wchan zeroed
reader: uid=1001 (maxx), NOT in wheel.

===== PATCHED KERNEL #1 RUN 1 (decisive) =====
running as uid=1001 (./leak_kinfo); self pid=850
reading kern.proc.* (KERN_PROC_PID/ALL -> PRISON_CHECK only, no p_trespass gate)

== self ==
  pid 850    uid=1001 comm=leak_kinfo      
      kp_paddr   = 0x0000000000000000  
      kp_fd      = 0x0000000000000000  
      kl_wchan   = 0x0000000000000000  
      kp_ktaddr  = 0x0000000000000000  
== pid 1 (init) ==
  pid 1      uid=0    comm=init            
      kp_paddr   = 0x0000000000000000  
      kp_fd      = 0x0000000000000000  
      kl_wchan   = 0x0000000000000000  
      kp_ktaddr  = 0x0000000000000000  

=== stability check: read pid 1 three times, kp_paddr must match ===
  pid 1 kp_paddr: 0x0000000000000000 / 0x0000000000000000 / 0x0000000000000000  (STABLE = real struct proc address)

result: 0 kernel pointers leaked across 0 processes (of 23 total readable)
result: no kernel pointers observed (fields appear redacted)
RUN_EXIT=2

===== determinism (3 runs on patched #1) =====
run1: 0 pointers / 0 procs (of 23 readable)  RUN_EXIT=2
run2: 0 pointers / 0 procs (of 24 readable)  RUN_EXIT=2
run3: 0 pointers / 0 procs (of 23 readable)  RUN_EXIT=2

All four kernel-pointer fields (kp_paddr, kp_fd, kl_wchan, kp_ktaddr) are zero for
every readable process. The sysctl access path is unchanged (23-24 procs still readable,
PRISON_CHECK still the only gate), so no functional regression — only the kernel
addresses are redacted to 0 before copyout.

BEFORE/AFTER CONTRAST:
  baseline #0 (unpatched): 69 kernel pointers leaked across 23 processes, RUN_EXIT=0
  patched  #1 (this fix) :  0 kernel pointers leaked across 23 processes, RUN_EXIT=2
  => fix closes the leak completely.