DF-0016 BASELINE — unpatched DragonFly 6.5-DEVELOPMENT #0 (Thu Jul  2 06:02:54 UTC 2026)
reader: uid=1001 (maxx), NOT in wheel, NOT the owner of the target pids.

decisive baseline run (run 1 of 3):
running as uid=1001 (./leak_kinfo); self pid=875
reading kern.proc.* (KERN_PROC_PID/ALL -> PRISON_CHECK only, no p_trespass gate)

== self ==
  pid 875    uid=1001 comm=leak_kinfo      
      kp_paddr   = 0xfffff80116e97780  (struct proc slab)
      kp_fd      = 0xfffff80116eceb40  (filedesc slab)
      kl_wchan   = 0x0000000000000000  
      kp_ktaddr  = 0x0000000000000000  
== pid 1 (init) ==
  pid 1      uid=0    comm=init            
      kp_paddr   = 0xfffff80089977280  (struct proc slab)
      kp_fd      = 0xfffff8008d2254c0  (filedesc slab)
      kl_wchan   = 0xfffff80089977280  (wait channel)
      kp_ktaddr  = 0x0000000000000000  

=== stability check: read pid 1 three times, kp_paddr must match ===
  pid 1 kp_paddr: 0xfffff80089977280 / 0xfffff80089977280 / 0xfffff80089977280  (STABLE = real struct proc address)

result: 69 kernel pointers leaked across 23 processes (of 23 total readable)
result: LEAK CONFIRMED (KASLR-defeat / slab-address primitive)
RUN_EXIT=0

== variance over 3 runs ==
run1: 69 pointers / 23 procs  (self kp_paddr 0xfffff80116e97780)
run2: 69 pointers / 23 procs  (self kp_paddr 0xfffff8008997b880)
run3: 69 pointers / 23 procs  (self kp_paddr 0xfffff80116e97c80)
- root-daemon slab addresses byte-identical across all 3 runs (e.g. init
  kp_paddr = 0xfffff80089977280 every time) -> real, fixed live kernel objects.
- self (leak_kinfo) kp_paddr differs run-to-run -> new process, new slab
  object, itself confirming these are live slab allocations, not residue.

Every readable process (23 of 23) leaks 2-3 kernel-range pointers from
{kp_paddr (kern_kinfo.c:128), kp_fd (kern_kinfo.c:129), kl_wchan (kern_kinfo.c:272/321)}.
kp_ktaddr (kern_kinfo.c:301) is only set for kernel threads, hence 0 for normal procs.