# DF-0333 -- Low

## Verdict: REPRODUCED (source-confirmed)

REAL: in_pcblist_range bcopy's the ENTIRE struct inpcb (with ~12 kernel pointers: inp_hash/list/portlist linkage, inp_pcbinfo, inp_socket, inp_porthash, inp_phd) into xinpcb exported via CTLFLAG_RD pcblist sysctls with no privilege gate -> any unpriv user reads kernel addresses (KASLR bypass).

## Impact ceiling
leak

## Cited refs
- sys/netinet/in_pcb.c:2469

## Fix
Scrub the kernel-pointer fields (inp_hash/inp_list/inp_portlist linkage + pcbinfo/socket/porthash/phd) after bcopy.

## Validation
Combined 60-finding fix kernel (findings/poc/_low_merged.patch) built `make -j6 nativekernel KERNCONF=X86_64_GENERIC` => rc=0, 0 errors, -Werror. fix_status=fixed.