DF-0716: racing smb_strdupin for 200000 iterations...
  string: 127 'A's on page A + NUL on page B (page boundary)
  racer:   toggling page B PROT_NONE <-> PROT_READ|PROT_WRITE
  [RACE WON iter 1] result bytes (hex, first 128):
    4141414141414141414141414141414141414141414141414141414141414141
    4141414141414141414141414141414141414141414141414141414141414141
    4141414141414141414141414141414141414141414141414141414141414141
    414141414141414141414141414141414141414141414141b03b020000000000
    
    expected: 41*127 + 00, got stale at byte 0 onward
DF-0716: done.
  iterations:  200000
  NULL (length loop caught fault): 63188
  OK (no race, correct string):    136811
  RACE WON (stale bytes returned):  1
  ==> BUG CONFIRMED: copyin return ignored, stale slab contents returned
RACE_RC=0

=== ANALYSIS ===
The race was won on iteration 1 (of 200000). The result buffer shows:
  - Bytes 0-119:   0x41 ('A') — correctly copied by bulk copyin
  - Bytes 120-127: b0 3b 02 00 00 00 00 00 — STALE SLAB CONTENTS

The bulk copyin at smb_subr.c:129 read in 8-byte chunks. The last 8-byte
chunk (bytes 120-127) straddled the page boundary (bytes 120-126 on page A,
byte 127 on page B). When the racing thread set page B to PROT_NONE, the
8-byte read faulted, leaving bytes 120-127 uninitialised — stale heap data
from a previous M_SMBSTR allocation.

The copyin return value (EFAULT) was IGNORED (smb_subr.c:129), so the
partially-filled buffer was returned as-is. The caller (smb_usr.c:308-312)
checks for NULL but the buffer is non-NULL, so it proceeds to use it as
t2p->t_name — which would be sent to the SMB server via TRANS2.

The stale bytes (b0 3b 02 00 00 00 00 00 = 0x0000000000023bb0 in LE) are
real kernel heap data (debug.use_weird_array=0, so no 0xdeadc0de poisoning).
This is a kernel heap info leak to an attacker-controlled SMB server.

Subsequent runs (2.6M+ iterations) did not win the race again — the window
is extremely narrow (kmalloc M_WAITOK is the only widening factor and does
not reliably sleep on this guest). The code defect is confirmed by source
trace (smb_subr.c:129 ignores copyin return) and by the single successful
race demonstration above.

=== ENVIRONMENT ===
DragonFly dfbsd 6.5-DEVELOPMENT DragonFly 6.5-DEVELOPMENT #0: Thu Jul  2 06:02:54 UTC 2026     root@dfbsd:/usr/obj/usr/src/sys/X86_64_GENERIC  x86_64
cc 8.3 [DragonFly] Release/2019-02-22
kldstat: smbfs.ko, strdup_test.ko loaded
/dev/nsmb: crwx------ root:wheel (0700 — root-only)
/dev/strdup_test: crw------- root:wheel (0600 — root-only test harness)
debug.use_weird_array=0 (no 0xdeadc0de slab poisoning)
vm.randomize_mmap=0 (no KASLR)
vfs.usermount=0