# DF-0027 — PoC

`wait_leak.c` — unprivileged leak of uninitialized kernel stack via
`wait4(child, &status, WNOHANG, &ru)`.

## The bug

`sys_wait4` (`sys/kern/kern_exit.c:913-948`) declares uninitialized locals
`int status;` (`:918`) and `struct __wrusage wrusage;` (`:916`), calls
`kern_wait(&status, ..., &wrusage, ...)`, and `copyout`s them whenever
`error == 0` (`:942`/`:945`). `sys_wait6` does the same and also copies out a
`siginfo_t`.

`kern_wait` returns `error == 0` on the `WNOHANG`-no-match path (`:1427-1431`:
`*res = 0; error = 0; goto done`) **without** writing `*status`/`*wrusage`/
`*info`, and on the `WCONTINUED` path leaves `*wrusage` untouched. So a caller
with a running (non-waitable) child samples 4 B (`status`) + ~72 B (`wait4`
`rusage`) — up to ~144 B (`wait6` `wrusage`) + ~128 B (`siginfo`) — of
uninitialized kernel stack per call.

## Build & run (unprivileged)

```
cc -o wait_leak findings/poc/DF-0027/wait_leak.c
./wait_leak
```

## Expected output (bug present)

```
iter  0: status=0x<residue> (LEAKED)  rusage-nonzero-byte (LEAKED)
...
result: N/50 iterations leaked kernel-stack bytes
result: LEAK CONFIRMED
```

The leaked bytes vary (kernel-stack residue from prior syscalls) — a samplable
KASLR/stack-residue oracle.