$ id (run as unprivileged user nobody via vm.sh run_user)
uid=65534(nobody) gid=65534(nobody)

boot A:
$ /tmp/smcleak   (x3 runs, identical)
fanid returned 9 bytes:
hex: 4c454654c043b68b00
ascii: 'LEFT.C...'

boot B (fresh stack):
$ /tmp/smcleak
fanid returned 17 bytes:
hex: 4c454654c0e2631701f8ffff1820668d00
ascii: 'LEFT..c...... f..'

Decoded (boot B): "LEFT" = the 4-byte fan name (buf[4..7]); then
c0 e2 63 17 01 f8 ff ff = an uninitialized 0xfffff8011763e2c0-class
KERNEL-POINTER FRAGMENT from buf[8..15]; then 18 20 66 8d = 4 more
stack bytes; walk stopped at the 0x00.  The MMIO backend fills only
min(reported=8, requested=16) at smc_mmio.c:74-76; buf[8..15] is
never written; sysctl_handle_string(oidp, desc, 0, req) at
smc_sysctl.c:61 strlen()s from desc=buf+4 through the uninitialized
tail until a NUL.

Fatal variant (observed 01:1x UTC, rig loaded, `sysctl -a` enumeration
hit the production handler with no prior stack writes):
  panic: assertion "obj != NULL" failed in vm_object_hold_shared
  Fatal user address access from kernel mode from sysctl
  Fatal trap 12: fault virtual address = 0x219225840
i.e. with an unlucky stack the strlen walk runs to an unmapped page.