# DF-0256 -- Low

## Verdict: REPRODUCED (source-confirmed)

REAL: kcore_make_file copies raw kernel pointers f_file (struct file*) and f_data into kinfo_file; kern.file is CTLFLAG_RD with no privilege gate -> any unpriv user reads kernel heap addresses (KASLR bypass). Confirmed.

## Impact ceiling
leak

## Cited refs
- sys/kern/subr_kcore.c:66
- sys/kern/subr_kcore.c:67

## Fix
Zero f_file/f_data in the exported kinfo_file so no kernel pointer is disclosed.

## Validation
Combined 60-finding fix kernel (findings/poc/_low_merged.patch) built `make -j6 nativekernel KERNCONF=X86_64_GENERIC` => rc=0, 0 errors, -Werror. fix_status=fixed.