# DF-0050 — PoC

`msg_leak.c` — unprivileged leak of kernel heap pointers (`msg_first`/
`msg_last`) + uninitialized padding via `msgctl(IPC_STAT)`.

## The bug

`sys_msgctl` IPC_STAT (`sys/kern/sysv_msg.c:324`) does
`copyout(msqptr, user_msqptr, sizeof(struct msqid_ds))` with no sanitization.
`struct msqid_ds` (`sys/sys/msg.h:68-84`) carries `struct msg *msg_first`
(`:70`) and `*msg_last` (`:71`) (live kernel heap pointers) and `msg_pad1..4`
(`:78,:80,:82,:83`) that are never zeroed (boot `kmalloc` at `sysv_msg.c:130`
without `M_ZERO`).

## Build & run (unprivileged)

```
cc -o msg_leak findings/poc/DF-0050/msg_leak.c
./msg_leak
```

## Expected output (bug present)

```
msg_first = 0xffff<...>
msg_last  = 0xffff<...>
-> kernel heap address disclosed to uid=1000 (KASLR/ASLR bypass)
```