{
  "finding_id": "DF-2224",
  "status": "reproduced",
  "reproduced": 1,
  "impact": "leak",
  "confidence": "certain",
  "verdict": "Reproduced mechanically with the verbatim production seq_printf(): on x86-64 SysV the __va_list decays to a pointer that lands in ksnprintfs first variadic slot, so no caller argument ever reaches the formatter. With identical variadic arguments the baseline produces 402699856/48879/5f5e100 where the fixed copy (kvsnprintf, one token from fix.diff in the same kernel) produces 111/222222/beef; the first baseline conversion is the low 32 bits of the va_list address (a kernel stack address). The leak flavor is directly demonstrated: seq_printf(m, ptr=%p, 0xdeadbeef) prints a kernel stack address (0xfffff8011800b650) instead of the argument, landing 0x9c bytes from the rig witness stack address in the same thread stack, stable in canonical kernel-stack shape across 3 runs; %s prints the single byte 0x10 (the va_list struct gp_offset, deterministic ABI artifact) instead of hi. Canary zones on both sides of the 64-byte seq buffer are intact in every case (ksnprintf/kvsnprintf bound-respect, no overflow). LATENT in the stock tree: CONFIG_DEBUG_FS is undefined so every i915 debugfs show callback is compiled out and drm_dp_downstream_debug has zero in-tree callers - the demonstrated primitive requires a future/ported caller. No write primitive, no privesc chain; ceiling is a kernel-stack-address disclosure (KASLR-defeating) plus garbage output if any caller is ever enabled. Fix validated A/B in the same kernel.",
  "exploit_chain": "",
  "evidence": "run.log lines DF2224 BASELINE/FIXED: baseline buf=[402699856/48879/5f5e100] vs fixed buf=[111/222222/beef]; %p baseline buf=[ptr=0xfffff8011800b650] vs rig witness 0xfffff8011800b6ec (same stack, 0x9c apart) vs fixed ptr=0xdeadbeef; %s baseline s=[0x10] vs fixed s=[hi]; canaries=INTACT everywhere; third run (notes) shows the same stack-shaped %p value",
  "kernel_refs": ["sys/dev/drm/linux_printf.c:37", "sys/dev/drm/include/linux/seq_file.h:39", "sys/dev/drm/drm_dp_helper.c:586", "sys/dev/drm/drm_dp_helper.c:662", "sys/dev/drm/i915/i915_gem_gtt.c:1540", "sys/dev/drm/kconfig.h"],
  "poc_changes": "Rebuilt as verbatim-code kernel-compiled rig; PoC sketch rewritten to call the variadic baseline and fixed functions directly with identical arguments (a va_list trampoline would have changed the register setup); 64-byte canary-bracketed seq buffer; witness stack address printed for the %p leak comparison",
  "attempts": 3,
  "guest_uname": "DragonFly dfbsd 6.5-DEVELOPMENT DragonFly 6.5-DEVELOPMENT #1: Tue Oct 20 23:24:18 UTC 2026     root@dfbsd:/usr/obj/usr/src/sys/DFV22X  x86_64",
  "runtime_sec": 15,
  "guest_dirty": 0,
  "build_cmd": "sh /root/poc/df22x/build.sh (nativekernel KERNCONF=DFV22X, rig compiled kernel-resident)",
  "run_cmd": "sh /root/poc/df22x/run.sh  (sysctl kern.df22x_run=1 as root on the DFV22X harness kernel)",
  "code_hash": "c646506a8cbeda4dcb0ade737617a507fac86cf3d381b7df14e25aad5ab10fae",
  "notes": "Batch verification run with DF-2216/2220/2223; guest reset with-src before return. LATENT in-tree (CONFIG_DEBUG_FS undefined, drm_dp_downstream_debug uncalled) - the defect and its leak primitive are proven through the verbatim function, but no stock-system trigger exists today; severity stays Low. %p values across runs: 0xfffff801166db650, 0xfffff8011800b650, 0xfffff80118005650 - all kernel-stack canonical, each within 0x9c of that runs witness",
  "recommended_fix": "Forward the va_list with kvsnprintf instead of ksnprintf (one token, see fix.diff)",
  "fix_status": "fixed",
  "fix_validated": 1,
  "fix_diff": "fix.diff"
}