DF-0025 leak sample — unprivileged kldsym/kldstat output on UNPATCHED #0 kernel
(runs as maxx uid 1001, default GENERIC kernel). Address leaks are stable across
boots because KASLR is OFF on this audit guest; on a KASLR-on kernel these would
leak the actual randomized addresses (defeating KASLR).

run 1:
  kldsym("proc0") = 0xffffffff81176920
  kernel    id=1 base=0xffffffff80200000 size=28149048 refs=5
  ehci.ko   id=2 base=0xffffffff81cd9000 size= 508552 refs=1
  xhci.ko   id=3 base=0xffffffff81d56000 size= 575352 refs=1

run 2:
  kldsym("proc0") = 0xffffffff81176920
  kernel    id=1 base=0xffffffff80200000 size=28149048 refs=5
  ehci.ko   id=2 base=0xffffffff81cd9000 size= 508552 refs=1
  xhci.ko   id=3 base=0xffffffff81d56000 size= 575352 refs=1

run 3:
  kldsym("proc0") = 0xffffffff81176920
  kernel    id=1 base=0xffffffff80200000 size=28149048 refs=5
  ehci.ko   id=2 base=0xffffffff81cd9000 size= 508552 refs=1
  xhci.ko   id=3 base=0xffffffff81d56000 size= 575352 refs=1

Cross-check (root): nm /boot/kernel/kernel.debug | grep -w proc0
  ffffffff81176920 B proc0          <-- matches kldsym leak exactly