# DF-0388 — Kernel heap info leak via uninitialized rt_msghdr in NET_RT_DUMP

## Bug
`sys/net/rtsock.c:1676`:
```c
w->w_buf = kmalloc(w->w_bufsz, M_TEMP, M_WAITOK | M_NULLOK);   /* NO M_ZERO */
```
The buffer is then partially filled: `rt_msg_buffer` writes `rtm_msglen` /
`rtm_version` / `rtm_type` (first 4 bytes); `rttable_walk_entry`
(`rtsock.c:1795-1801`) writes `rtm_flags`, `rtm_use`, `rtm_rmx`, `rtm_index`,
`rtm_errno`, `rtm_pid`, `rtm_seq`, `rtm_addrs`. The following fields of
`struct rt_msghdr` (`sys/net/route.h:211`) are **never** written:

* `rtm_inits` — `u_long` at offset 32 (8 bytes on 64-bit)
* 2 bytes of struct padding between `rtm_index` (u_short @ off 4) and
  `rtm_flags` (int @ off 8)

These unwritten bytes are emitted verbatim by `SYSCTL_OUT(req, w->w_buf, ...)`
(`rtsock.c:1855`). Because the `kmalloc` lacks `M_ZERO`, the bytes carry stale
`M_TEMP` slab residue from whatever allocation previously occupied that memory.

`sysctl_rtsock` is registered `CTLFLAG_RD` (`rtsock.c:1928`) — the only
privilege check (`:1884`) blocks writes (`req->newptr`). Any unprivileged
local user can dump routes and harvest the stale bytes.

## Reach (one sysctl from any user)
```
sysctl(NET/PF_ROUTE/0/af/NET_RT_DUMP/0)   /* read, unprivileged */
```
or equivalently any process doing `RTM_GET` over the routing socket. The PoC
uses `sysctl(2)` so no socket privilege is required at all.

## Build / Run
```
cc -O2 -Wall -o df_0388_leak df_0388_leak.c
./df_0388_leak          # any user; runs the dump 4x with slab perturbation
```

## Expected (bug present)
* `rtm_inits != 0` for at least one record per dump.
* The OR of all `rtm_inits` values varies across runs/dumps (different slab
  residue each time), and frequently contains kernel pointers
  (`0x01db06xx`, `0x08993950`, `0xffffffffffff7f7c` …) and IPv4 addresses
  (`0x0100007f…` = 127.0.0.1).
* The 2 bytes of index/flags padding also come up non-zero (`0x5254` "RT",
  `0x0021` …).

## Expected (fix present)
* `rtm_inits` is `0x0000000000000000` for every record in every dump.
* The index/flags padding is `0x0000` everywhere.

## Preconditions
None — `NET_RT_DUMP` is unprivileged. Module/kernel: base `rtsock.c` (no
`kldload`).