# DF-0016 leak sample — unredacted kernel pointers in kern.proc.* (kinfo_proc)
# Guest (UNPATCHED baseline): DragonFly 6.5-DEVELOPMENT #0 (Thu Jul  2 06:02:54 UTC 2026)
# Reader: uid=1001 (maxx), NOT in wheel, NOT the owner of the target pids.
#
# sysctl_kern_proc (KERN_PROC_PID, kern_proc.c:1686) only checks PRISON_CHECK
# (jail) -- NOT p_trespass. fill_kinfo_proc / fill_kinfo_lwp write raw kernel
# virtual addresses into user-visible kinfo fields, copied out unredacted via
# sysctl_out_proc (kern_proc.c:1603/1612/1633). An unprivileged user can thus
# read the struct-proc slab address, filedesc slab address, and wait-channel
# of ANY pid (including every root daemon).

## decisive baseline run (#0): self + init
pid 850    uid=1001 comm=leak_kinfo
    kp_paddr   = 0xfffff80116e97780   (struct proc slab)     kern_kinfo.c:128
    kp_fd      = 0xfffff80116eceb40   (filedesc slab)        kern_kinfo.c:129
    kl_wchan   = 0x0000000000000000   (running, not blocked)
    kp_ktaddr  = 0x0000000000000000   (not a kernel thread)
pid 1      uid=0    comm=init
    kp_paddr   = 0xfffff80089977280   (struct proc slab)     kern_kinfo.c:128
    kp_fd      = 0xfffff8008d2254c0   (filedesc slab)        kern_kinfo.c:129
    kl_wchan   = 0xfffff80089977280   (wait channel)         kern_kinfo.c:272
    kp_ktaddr  = 0x0000000000000000

## full-system tally (#0): every readable process leaks 2-3 kernel pointers
result: 69 kernel pointers leaked across 23 processes (of 23 total readable)
result: LEAK CONFIRMED (KASLR-defeat / slab-address primitive)

## stability + variance
pid 1 kp_paddr: 0xfffff80089977280 / 0xfffff80089977280 / 0xfffff80089977280  (STABLE)
  - root-daemon slab addresses byte-identical across 3 runs (long-running procs
    don't relocate) -> real, fixed live kernel objects.
  - self (leak_kinfo) kp_paddr differs run-to-run (new process each run) ->
    new slab object, itself confirming these are live slab allocations.
The 0xfffff8xxxxxxxxxx values are DragonFly kernel KVA/malloc (slab) addresses;
they are confirmed real by being canonical upper-half kernel addresses (>=
0xffff800000000000), stable across reads, distinct per pid, and clustered in
slab-sized groups. (A .text-range wchan was observed in the prior session:
cron kl_wchan 0xffffffff8130f670 -> nm symbol nanowait, exact -- direct KASLR
defeat; see VERDICT.md.)

============================================================
## AFTER FIX (single-fix kernel #1, 19:25:22 UTC 2026):
============================================================
pid 1      uid=0    comm=init
    kp_paddr   = 0x0000000000000000     (REDACTED)
    kp_fd      = 0x0000000000000000     (REDACTED)
    kl_wchan   = 0x0000000000000000     (REDACTED)
    kp_ktaddr  = 0x0000000000000000     (REDACTED)
result: 0 kernel pointers leaked across 0 processes (of 23 total readable)
result: no kernel pointers observed (fields appear redacted)  RUN_EXIT=2

All four kernel-pointer fields are zero for every readable process. The sysctl
access path is unchanged (23 procs still readable, PRISON_CHECK still the only
gate) -- no functional regression, only the kernel addresses are redacted.

BEFORE/AFTER CONTRAST:
  baseline #0 (unpatched): 69 kernel pointers leaked across 23 procs, RUN_EXIT=0
  patched  #1 (this fix) :  0 kernel pointers leaked across 23 procs, RUN_EXIT=2