# DF-0185 — uninitialized kernel stack leak via vacl_get_acl (LATENT)

## Summary
`vacl_get_acl` (kern_acl.c:88) declares `struct acl inkernelacl` on the
stack without zeroing it; a future ACL-capable filesystem's VOP_GETACL
would leave entries `[acl_cnt..31]` uninitialized, and the copyout at
:99 leaks the whole struct to userspace.

## Status
LATENT on master: no in-tree FS implements VOP_GETACL
(`sys/kern/vfs_default.c:89` returns `EOPNOTSUPP`).

## Build / Run
```sh
./build.sh && ./run.sh
```
Expected: `__acl_get_file` returns EOPNOTSUPP; leak path not reached.

## Fix
`fix.diff`: `bzero(&inkernelacl, sizeof(inkernelacl))` before VOP_GETACL.
Validated as defense-in-depth (no behavioral change).

## Files
- `acl_leak.c` — `__acl_get_file` syscall probe.
- `fix.diff` — zero the struct.
- `VERDICT.md` — latent-pattern narrative.