DF-2543 / leak_sample.txt
## DF-2543 leak sample (3 runs, byte-identical => stable kernel addrs) ## device_t kernel pointers from hw.bus.devices, all in 0xfffff800 (canonical KVA) ## stride 0xa0 (160 bytes) reveals device_t slab layout [ 0] handle=0xfffff8008bb7f6c0* parent=0x0000000000000000 root0 [ 1] handle=0xfffff8008bb7f800* parent=0xfffff8008bb7f6c0* nexus0 [ 2] handle=0xfffff8008bb7f8a0* parent=0xfffff8008bb7f800* acpi0 [ 3] handle=0xfffff8008bb7f940* parent=0xfffff8008bb7f800* rdrand0 [ 4] handle=0xfffff8008bb7f9e0* parent=0xfffff8008bb7f800* ram0 [ 5] handle=0xfffff8008bb7fa80* parent=0xfffff8008bb7f800* legacy0 [ 6] handle=0xfffff8008bb7fb20* parent=0xfffff8008bb7f800* sc0 [ 7] handle=0xfffff8008bb7fc60* parent=0xfffff8008bb7f8a0* pcib0 [ 8] handle=0xfffff8008bb7fd00* parent=0xfffff8008bb7f8a0* [ 9] handle=0xfffff8008bb7fda0* parent=0xfffff8008bb7f8a0* [ 10] handle=0xfffff8008bb7fe40* parent=0xfffff8008bb7f8a0* [ 11] handle=0xfffff8008bb7fee0* parent=0xfffff8008bb7f8a0* ## summary across 3 runs: run.log: devices enumerated : 110 run.log: leaked dv_handle : 110 (raw device_t kernel pointers) run.log: leaked dv_parent : 109 (raw parent device_t kernel pointers) run.log: RESULT: LEAK CONFIRMED -- 219 raw kernel pointers disclosed (KASLR defeated) run.2.log: devices enumerated : 110 run.2.log: leaked dv_handle : 110 (raw device_t kernel pointers) run.2.log: leaked dv_parent : 109 (raw parent device_t kernel pointers) run.2.log: RESULT: LEAK CONFIRMED -- 219 raw kernel pointers disclosed (KASLR defeated) run.3.log: devices enumerated : 110 run.3.log: leaked dv_handle : 110 (raw device_t kernel pointers) run.3.log: leaked dv_parent : 109 (raw parent device_t kernel pointers) run.3.log: RESULT: LEAK CONFIRMED -- 219 raw kernel pointers disclosed (KASLR defeated)