# DF-0037 — PoC

`leak_pgid.c` — unprivileged enumeration of every process's pgid/session-id
via `getpgid`/`getsid` (no cross-session `EPERM`).

## The bug

`sys_getpgid` (`kern_prot.c:106-131`) and `sys_getsid` (`:136-158`) call
`pfind(arbitrary pid)` and return `pt->p_pgrp->pg_id` / `pt->p_session->s_sid`
with no `p_trespass`/`PRISON_CHECK`/session-equality check. POSIX mandates
`EPERM` for out-of-session targets; DragonFly returns the value to any caller.

## Build & run (unprivileged)

```
cc -o leak_pgid findings/poc/DF-0037/leak_pgid.c
./leak_pgid
```

## Expected output (bug present)

```
pid      1  pgid      1  sid      1
pid   <sshd> ... 
...
N processes' pgid/sid enumerated as uid=1000 (no EPERM)
```