# DF-0185 — Uninitialized kernel stack leak via vacl_get_acl (LATENT)

## Verdict: LATENT — bug confirmed by code inspection; copyout path
unreachable on this kernel because no in-tree FS implements VOP_GETACL.
Fix VALIDATED as defense-in-depth.

## Mechanism
`vacl_get_acl` (sys/kern/kern_acl.c:88-101) declares
```c
struct acl inkernelacl;          /* :92 -- NOT zeroed */
...
error = VOP_GETACL(vp, type, &inkernelacl, ucred);
if (error == 0)
    error = copyout(&inkernelacl, aclp, sizeof(struct acl));  /* :99 */
```
`struct acl` contains an array `acl_entry acl_entry[ACL_MAX_ENTRIES]`
(32 entries).  A correctly-implemented `VOP_GETACL` writes only the
first `acl_cnt` entries; entries `[acl_cnt..31]` remain uninitialized
kernel stack and are leaked to userspace by the full-struct copyout at
:99.

## Latent on this kernel
No in-tree filesystem overrides `VOP_GETACL`:
```
$ grep -rn '\.vop_getacl\s*=' sys/vfs sys/kern
sys/kern/vfs_default.c:89:    .vop_getacl = (void *)vop_eopnotsupp,
```
The default returns `EOPNOTSUPP`, so the `if (error == 0) copyout(...)`
guard at kern_acl.c:98 is never taken.  The bug becomes live the moment
an ACL-capable filesystem is added.

## Reproduction (latent state demonstrated)
```
$ ./acl_leak
DF-0185: __acl_get_file(/etc/passwd, ACL_TYPE_ACCESS) = -1 errno=45 (Operation not supported)
DF-0185: __acl_get_file(/tmp, ACL_TYPE_DEFAULT) = -1 errno=45 (Operation not supported)
DF-0185: VOP_GETACL returned EOPNOTSUPP (vfs_default.c:89) --
         copyout at kern_acl.c:99 NOT reached; leak is LATENT.
         Fix is still warranted (zero `inkernelacl` before the call).
```

## Fix (validated defense-in-depth)
`fix.diff` adds `bzero(&inkernelacl, sizeof(inkernelacl))` before the
`VOP_GETACL` call, matching what every well-audited copyout-style
syscall should do.  On the patched kernel (#1, sha256
bb88f4411402ab5bf93e4e4f51f98c54e7017c2f1b2c0c94a6b17ff697cfcb5a)
the behavior is unchanged (still EOPNOTSUPP) but the latent leak is
closed.

## Note
This is the canonical "latent" pattern (cf. DF-0594, DF-0616, DF-0281):
the bug exists in code, the trigger path is dead in master, the fix is
trivial and warranted as defense-in-depth.