# DF-2387 leak samples -- unprivileged (maxx, uid 1001) sysctl reads
# values are int32 prints of Elements[index].Integer.Value (UINT64->UINT32)
# baseline kernel #4 (verbatim driver), 2026-10-19

## canary attribution (sinf_mode=1: Package.Count=2, 9-element backing,
## elements past Count hold per-index canary 0xC2/0xC3/0xC4/0xC8 pattern)
reg2_max:  -1027423550   == 0xC2C2C2C2  (index 2, lcd_brightness_max)
reg3_min:  -1010580541   == 0xC3C3C3C3  (index 3, lcd_brightness_min)
reg4_brt:  -993737532    == 0xC4C4C4C4  (index 4, lcd_brightness)
reg8_mute: -926365496    == 0xC8C8C8C8  (index 8, sound_mute)
(run.log, single boot; identical values on the earlier boot of the same kernel)

## tight + same-zone spray (sinf_mode=3: 72-byte package allocation,
## six 0xEE-marked same-size chunks allocated directly behind it)
spray1 reg4_brt=-286331154 reg8_mute=-286331154
spray2 reg4_brt=-286331154 reg8_mute=-286331154
spray3 reg4_brt=-286331154 reg8_mute=-286331154
spray4 reg4_brt=-286331154 reg8_mute=-286331154
spray5 reg4_brt=-286331154 reg8_mute=-286331154
# -286331154 == 0xEEEEEEEE: reads at package+120 (reg4) and package+216
# (reg8) land 48+ bytes past the 72-byte chunk in the marked neighbor
# chunks -- cross-chunk kernel heap read disclosed to an unprivileged user.

## tight without grooming (sinf_mode=2): adjacent chunks were zeroed slab
tight1..tight5 reg4_brt=0 reg8_mute=0

## control (sinf_mode=4, 9-element package): 255 / 0 / 128 / 0

## fixed kernel #6: every short-package read returns -1 (15/15 across modes)