# DF-0136 — varsym_list(VARSYM_SYS) jail isolation breach

| | |
|---|---|
| Verdict | **REPRODUCED** |
| Impact | info-leak / jail isolation breach (host→jail) |
| File | `sys/kern/kern_varsym.c:263-264` |

## Build
```
cc -o leak_check leak_check.c
```

## Run
```
# (as root) plant a marker host system varsym, then enumerate inside a jail
./run.sh
#   which does:
#     varsym -s DF0136_HOSTSECRET=secretvalue
#     jail / dftest 127.0.0.1 /path/to/leak_check
```

## Expected (bug present)
```
RESULT: LEAK_CONFIRMED — host system varsyms are enumerable from inside a jail via varsym_list(VARSYM_SYS)
```
A jailed process enumerates ALL host system varsyms (126 on this guest), including
the planted `DF0136_HOSTSECRET=secretvalue`. The jail-scoped `varsym_get` path
correctly does NOT find the marker — proving the asymmetry (list leaks, get does not).

## Expected (fixed)
```
RESULT: NO_LEAK — jail isolation holds for varsym_list
```

See `VERDICT.md` for the full analysis and `fix.diff` for the patch.