=== BASELINE (unpatched kernel #0, Thu Jul 2 06:02:54 UTC 2026) ===

Kernel version:
DragonFly 6.5-DEVELOPMENT #0: Thu Jul  2 06:02:54 UTC 2026

Evidence the leak source is present:
$ strings /boot/kernel/kernel | grep "rxq: move info"
rxq: move info %p back to txq

The unconditional kprintf at sys/vfs/nfs/nfs_iod.c:135 is compiled into
the running kernel. The format string "rxq: move info %p back to txq\n"
prints the raw value of the `info` pointer — a kmalloc'd struct nfsm_info *
from M_NFSREQ (allocated at nfs_bio.c:1339) — to the kernel message buffer.

The msgbuf is readable by any local user when
security.unprivileged_read_msgbuf=1 (confirmed default on this guest).

The kprintf fires on the EINPROGRESS path in nfssvc_iod_reader() when
nfs_request() returns EINPROGRESS, which occurs when
nfs_request_processreply() returns EAGAIN (NFSERR_TRYLATER / JUKEBOX
from a malicious server, nfs_socket.c:1525) or ENEEDAUTH (Kerberos
auth error, nfs_socket.c:1478).