# DF-0993 — fill_dbregs() uninitialized dr[8]-dr[15] leak

## Summary
`fill_dbregs()` at `sys/platform/pc64/x86_64/machdep.c:3104-3130` populates
only `dr[0]`-`dr[7]` (64 bytes) of `struct dbreg` (128 bytes,
`sys/cpu/x86_64/include/reg.h:89`). `procfs_dbregs.c:57` declares
`struct dbreg r;` with **no zero-initialization**, then `uiomove_frombuf`
copies all 128 bytes back to userspace, leaking 64 bytes of uninitialized
kernel stack per read.

Same class as DF-0938 (fpregs leak). Reachable by any local user via
`/proc/self/dbregs` (the `p_trespass` check returns 0 for self, no privilege
needed) or via `ptrace(PT_GETDBREGS)` on a child.

## Build
```
cc -O -o dbregs_leak dbregs_leak.c
```

## Run
```
./dbregs_leak           # 3 rounds
./dbregs_leak 5 -v      # 5 rounds, verbose hex dump
```

## Expected (bug present)
- `dr[8]`-`dr[15]` are non-zero in at least some rounds (`LEAK` marker).
- Bytes vary across rounds (`variance: N of 8 high dwords differ`) — proof
  that they are live uninitialized stack residue, not a fixed sentinel.
- Sample residue frequently contains values that look like kernel pointers
  (high bits set) or kernel `.text` return addresses.

## Expected (fixed)
- `dr[8..15]` are `0x0` in every round (no residue, no variance).