{
 "status": "reproduced",
 "reproduced": 1,
 "impact": "leak",
 "confidence": "certain",
 "verdict": "Uninitialized kernel-stack disclosure via the production apple_smc_mb_sysctl_fanid handler, read as unprivileged user nobody through a fabricated MMIO/T2 backend reporting the documented 8-byte F0ID payload. sysctl returned the 4-byte fan name plus 12 bytes of never-written kernel stack (including a 0xfffff801xxxxxxxx kernel-pointer fragment), terminated only by a lucky NUL; with an unlucky stack the same strlen walk runs off the kstack top into a fatal kernel-mode fault (observed once accidentally).",
 "exploit_chain": "",
 "evidence": "run.log (9-byte and 17-byte leak samples, deterministic across runs and preceding syscalls); smcleak.c (unprivileged trigger); the accidental fatal-walk console trace in run.log",
 "kernel_refs": [
  "sys/dev/apple/smc/smc_sysctl.c:51",
  "sys/dev/apple/smc/smc_sysctl.c:56",
  "sys/dev/apple/smc/smc_sysctl.c:61",
  "sys/dev/apple/smc/smc_io.c:436",
  "sys/dev/apple/smc/smc_mmio.c:74"
 ],
 "poc_changes": "fabricated MMIO register file + fabricated apple_smc_softc behind a rig nexus device; the production handler is wired as a real world-readable sysctl (dev.dfsm.0.fanid) and runs end to end",
 "attempts": 4,
 "runtime_sec": 900,
 "guest_dirty": 0,
 "build_cmd": "see build.sh (dfhw.ko kld rig: verbatim apple_smc.ko symbols + fabricated softc/bus)",
 "run_cmd": "sysctl dev.dfsm.0.spray; sysctl dev.dfsm.0.fanid  (as user nobody)",
 "notes": "MMIO backend precondition confirmed: smc_mmio.c:74 fills min(reported=8, requested=16); port-IO backend fills all 16 (no leak). Leak ceiling: everything from buf[8] to the next NUL on the kstack; observed 4..12 bytes incl. kernel pointers.",
 "recommended_fix": "Clamp the requested read to the reported length and NUL-terminate: memset(buf,0,sizeof(buf)) before apple_smc_fan_getstring and pass a bounded string to sysctl_handle_string",
 "finding_id": "DF-2403",
 "guest_uname": "DragonFly dfbsd 6.5-DEVELOPMENT DragonFly 6.5-DEVELOPMENT #0: Thu Jul  2 06:02:54 UTC 2026 root@dfbsd:/usr/obj/usr/src/sys/X86_64_GENERIC x86_64",
 "runner": "df-bsd-reviewer",
 "code_hash": "a1a3444e66bed11c9f103dda5152eceb2bbd8e009ce3c1853be55d29298de82f"
}