# DF-0025 — PoC

`kld_leak.c` — unprivileged leak of kernel symbol addresses (`kldsym`) and
loaded-module base addresses (`kldstat`).

## The bug

`sys_kldstat` (`sys/kern/kern_linker.c:940`) and `sys_kldsym` (`:1024`) have no
`caps_priv_check_self(SYSCAP_NOKLD)` gate, unlike `sys_kldload` (`:794`) and
`sys_kldunload` (`:841`). `kldsym` resolves an arbitrary kernel symbol name to
its absolute runtime address; `kldstat` returns each loaded module's base
address (`lf->address`) and size. Any local user can dump a full
symbol→address map of the running kernel + every KLD.

## Build & run (unprivileged)

```
cc -o kld_leak findings/poc/DF-0025/kld_leak.c
./kld_leak
```

## Expected output (bug present)

```
[+] kldsym("proc0") = 0xffffffff81xxxxxx  (unprivileged KASLR/symbol leak)
[+] kldstat: loaded modules (base + size):
    kernel               id=1 base=0xffffffff80200000 size=1234567 refs=1
    ...
```

A complete kernel symbol map + module layout handed to any local user.