# DF-0034 — PoC

`leak_stpad.c` — unprivileged leak of 2 bytes of kernel stack via the
uninitialized `st_padding1` of `struct stat`.

## The bug

`vn_stat` (`sys/kern/vfs_vnops.c:833-977`) zeroes `st_lspare` and
`st_qspare2` (`:852-853`) but never writes `st_padding1` (`sys/sys/stat.h:105`,
`__uint16_t`). Every stat syscall handler declares `struct stat st;` on the
kernel stack unzeroed and `copyout(sizeof(struct stat))`, leaking 2 bytes of
uninitialized kernel stack per `fstat`/`stat`/`lstat`/`fstatat`/`fhstat`.

## Build & run (unprivileged)

```
cc -o leak_stpad findings/poc/DF-0034/leak_stpad.c
./leak_stpad
```

## Expected output (bug present)

```
sample 0: st_padding1 = <..> <..>
...
samples with non-marker/non-zero st_padding1 byte: N
result: LEAK CONFIRMED
```