================================================================
DF-1056 LEAK SAMPLES — unpatched (#0) vs patched (#1)
================================================================

==================================================
UNPATCHED BASELINE: 6.5-DEVELOPMENT #0 (Jul 2 06:02:54)
sha256(kernel) = 5dc83dac19ad09effd6241c33e0c0669d41b6497ee92d87d3a2e45f287bc22ad
==================================================

--- ptrace PT_GETFPREGS — 3 stress runs (byte-count varies = real stack residue) ---

run 1 (316 leaked bytes):
PT_GETFPREGS returned 512 bytes, 316 non-zero/non-poison in [108..511]
  fpregs[+128] = 0xfffff80117ff0518   ← KVA kernel pointer
  fpregs[+136] = 0xfffff80116baae80   ← KVA kernel pointer
  fpregs[+144] = 0x000000010d47a467
  fpregs[+152] = 0xfffff80116baafa0   ← KVA kernel pointer
  fpregs[+160] = 0xfffff80117ff0558   ← KVA kernel pointer
  fpregs[+168] = 0xffffffff80c18ac4   ← kernel-text return address (fixed)
  fpregs[+176] = 0xfffff80117ff0598   ← KVA kernel pointer
  fpregs[+184] = 0x000000010d47a405

run 2 (310 leaked bytes):
PT_GETFPREGS returned 512 bytes, 310 non-zero/non-poison in [108..511]
  fpregs[+128] = 0xfffff801182f7518   ← different per-fork stack addr
  fpregs[+136] = 0xfffff80116baa280
  fpregs[+144] = 0x000000010d82c467
  fpregs[+152] = 0xfffff80116baa3a0
  fpregs[+160] = 0xfffff801182f7558
  fpregs[+168] = 0xffffffff80c18ac4   ← same fixed text addr (KASLR off)
  fpregs[+176] = 0xfffff801182f7598
  fpregs[+184] = 0x000000010d82c405

run 3 (313 leaked bytes):
PT_GETFPREGS returned 512 bytes, 313 non-zero/non-poison in [108..511]
  fpregs[+128] = 0xfffff801183d1518
  fpregs[+136] = 0xfffff80116bad280
  fpregs[+144] = 0x000000010d840467
  fpregs[+152] = 0xfffff80116bad3a0
  fpregs[+160] = 0xfffff801183d1558
  fpregs[+168] = 0xffffffff80c18ac4
  fpregs[+176] = 0xfffff801183d1598
  fpregs[+184] = 0x000000010d840405

--- procfs /proc/PID/fpregs — raw hex of bytes [108..259] (268 non-zero total in [108..511]) ---

ff ff ff ff 12 00 00 00 00 00 00 00 4c 7f 34 48
00 f8 ff ff 80 5c 72 81 ff ff ff ff 00 7f 34 48
00 f8 ff ff 48 16 3d 18 01 f8 ff ff b4 3d 9b 80
ff ff ff ff 88 18 3d 18 01 f8 ff ff 00 80 cd 8d
00 f8 ff ff 80 95 97 89 00 f8 ff ff 02 04 00 00
00 00 00 00 00 00 00 00 00 00 00 00 00 04 00 00
6c 5e 75 81 ff ff ff ff 6c 5e 72 81 ff ff ff ff
80 95 97 89 00 f8 ff ff 18 e6 c0 80 ff ff ff ff
38 16 3d 18 01 f8 ff ff 18 fd c0 80 ff ff ff ff
12 00 00 00

(Little-endian: "00 f8 ff ff" = high half of 0xfffff800... KVA pointer;
 "ff ff ff ff 80 ..." = 0xffffffff80... kernel-text pointer.)


==================================================
PATCHED SINGLE-FIX: 6.5-DEVELOPMENT #1 (Jul 14 17:58:00)
sha256(kernel) = 77022b65fc49e3544bc7896264d22799dfa10b836d3f73f82dd9562777dc7d43
fix = bzero(fpregs, sizeof(*fpregs)) in machdep.c:fill_fpregs
==================================================

--- ptrace PT_GETFPREGS — 3 runs ---

run 1: PT_GETFPREGS returned 512 bytes, 0 non-zero/non-poison in [108..511]
  fpregs[+128] = 0x0000000000000000
  fpregs[+136] = 0x0000000000000000
  ... (all 8 words = 0x0)

run 2: PT_GETFPREGS returned 512 bytes, 0 non-zero/non-poison in [108..511]
  (all zero)

run 3: PT_GETFPREGS returned 512 bytes, 0 non-zero/non-poison in [108..511]
  (all zero)

--- procfs /proc/PID/fpregs (C reader) — 3 runs ---

run 1: /proc/PID/fpregs read 512 bytes, 0 non-zero in [108..511]
run 2: /proc/PID/fpregs read 512 bytes, 0 non-zero in [108..511]
run 3: /proc/PID/fpregs read 512 bytes, 0 non-zero in [108..511]


==================================================
SUMMARY: unpatched 310-316 leaked bytes → patched 0 leaked bytes
Leak fully closed on both ptrace and procfs paths.
==================================================