=======================================================================
DF-0022 — decisive run: privilege-drop KCBIND test
=======================================================================

--- KERNEL: PPS_SYNC #1 (NO FIX) — BUG PRESENT (before) ---
Kernel: DragonFly 6.5-DEVELOPMENT #1: Sun Jul 12 17:48:30 UTC 2026
       (X86_64_GENERIC + options PPS_SYNC, NO privilege-check fix)

$ ./kcbind_drop /dev/ttyd0     (root opens fd, drops to uid=1001, issues ioctl)
setgroups: Operation not permitted
[*] now running as uid=1001 euid=1001 gid=1001
[+] KCBIND succeeded under uid=1001 (privilege bypass) on /dev/ttyd0
[+] hardpps() consumer bound with NO privilege check;
    pps->kcmode = PPS_CAPTUREASSERT.
rc=0

==> BUG CONFIRMED: unprivileged credential executes PPS_IOC_KCBIND.

-----------------------------------------------------------------------

--- KERNEL: PPS_SYNC #1 + fix.diff — FIXED (after) ---
Kernel: DragonFly 6.5-DEVELOPMENT #1: Sun Jul 12 18:20:02 UTC 2026
       (X86_64_GENERIC + options PPS_SYNC + caps_priv_check_self fix)

$ ./kcbind_drop /dev/ttyd0
setgroups: Operation not permitted
[*] now running as uid=1001 euid=1001 gid=1001
[-] KCBIND rejected under uid=1001: Operation not permitted (errno=1)
rc=0

==> FIX VALIDATED: unprivileged credential now gets EPERM.

--- sanity: root retains access on fixed kernel ---
$ ./root_bind /dev/ttyd0
[root] KCBIND OK (uid=0) - root retains access
rc=0

==> fix is correctly scoped: blocks unprivileged, allows root.