=== DF-2548 kern.ttys pointer leak — raw leaked pointers (unpatched #0 baseline) ===
=== Read as uid 1001 (maxx, NOT in wheel). 3 consecutive runs, byte-identical (deterministic). ===

--- Run 1 (decisive baseline run, full output in run.log) ---
  blob off    24  TEXT/FN : 0xffffffff80c64d8d
  blob off    48  HEAP/DM : 0xfffff801168fb400
  blob off    80  HEAP/DM : 0xfffff801168db800
  blob off   112  HEAP/DM : 0xfffff8008d4a3800
  blob off   160  HEAP/DM : 0xfffff8011690f808
  blob off   168  HEAP/DM : 0xfffff8011692de10
  blob off   256  TEXT/FN : 0xffffffff80b8c0f0
  blob off   264  TEXT/FN : 0xffffffff806b87a0
  blob off   272  TEXT/FN : 0xffffffff80b87220
  blob off   352  HEAP/DM : 0xfffff8011865b600
  blob off   360  TEXT/FN : 0xffffffff810e5200
  blob off   400  TEXT/FN : 0xffffffff80c64d8d
  blob off   424  HEAP/DM : 0xfffff8008bbb6c00
  blob off   456  HEAP/DM : 0xfffff8008dcf1800
  blob off   488  HEAP/DM : 0xfffff8008d200200
  blob off   536  HEAP/DM : 0xfffff8004f1c6208
  blob off   544  HEAP/DM : 0xfffff8008bb1fee8
  blob off   632  TEXT/FN : 0xffffffff80b8c0f0
  blob off   640  TEXT/FN : 0xffffffff806b87a0
  blob off   648  TEXT/FN : 0xffffffff80b87220
  blob off   728  HEAP/DM : 0xfffff8011865b600
  blob off   736  HEAP/DM : 0xfffff8004f2e5f00
  blob off   776  TEXT/FN : 0xffffffff80c64d8d
  blob off   800  HEAP/DM : 0xfffff801182bd800
  blob off   832  HEAP/DM : 0xfffff80118295800
  blob off   864  HEAP/DM : 0xfffff8008d5d6a00
  blob off   912  HEAP/DM : 0xfffff80118058bb0
  blob off   920  HEAP/DM : 0xfffff80116d4e630
  blob off  1008  TEXT/FN : 0xffffffff80b8c0f0
  blob off  1016  TEXT/FN : 0xffffffff806b87a0
  blob off  1024  TEXT/FN : 0xffffffff80b87220
  blob off  1104  HEAP/DM : 0xfffff8011865b600
  blob off  1112  HEAP/DM : 0xfffff8004f2e5d80
  blob off  1152  TEXT/FN : 0xffffffff80c64d8d
  blob off  1176  HEAP/DM : 0xfffff801182a0400
  blob off  1208  HEAP/DM : 0xfffff80118296000
  blob off  1240  HEAP/DM : 0xfffff8008d5d7c00
  blob off  1288  HEAP/DM : 0xfffff80118058c28
  blob off  1296  HEAP/DM : 0xfffff80116d4e698
  blob off  1384  TEXT/FN : 0xffffffff80b8c0f0
  blob off  1392  TEXT/FN : 0xffffffff806b87a0
  blob off  1400  TEXT/FN : 0xffffffff80b87220
  blob off  1480  HEAP/DM : 0xfffff8011865b600
  blob off  1488  HEAP/DM : 0xfffff8004f2e5c00
  blob off  1528  TEXT/FN : 0xffffffff80c64d8d
  blob off  1552  HEAP/DM : 0xfffff80118312400
  blob off  1584  HEAP/DM : 0xfffff801182f6800
  blob off  1616  HEAP/DM : 0xfffff8008d6f7c00
TOTAL kernel-range pointers leaked      : 102
  of which kernel .text/.rodata (FN)    : 38
  of which heap/direct-map              : 64
VERDICT: LEAK CONFIRMED — unprivileged user obtained 102 raw kernel pointers from kern.ttys (KASLR-defeating).

--- Run 2 (run.2.log) — variance check ---
TOTAL kernel-range pointers leaked      : 102
  of which kernel .text/.rodata (FN)    : 38
  of which heap/direct-map              : 64

--- Run 3 (run.3.log) — variance check ---
TOTAL kernel-range pointers leaked      : 102
  of which kernel .text/.rodata (FN)    : 38
  of which heap/direct-map              : 64

=== Cross-reference: leaked .text addresses vs /boot/kernel/kernel symbols ===
  0xffffffff806b87a0  (appears at intra-record off 264/640/1016/1392 = t_stop)
    -> near ttyread (0xffffffff806b87b0), ptsstart (0xffffffff806bac90),
       ptsstop (0xffffffff806bac00), ptsunhold (0xffffffff806b9ce0)
  These are kernel .text addresses -> directly defeats KASLR base.

=== Pattern: driver function pointers repeat identically across records ===
  (t_oproc/t_stop/t_param/t_unhold are static driver symbols; same addr every record)
  offsets 256/264/272/360 == 632/640/648/728 == 1008/1016/1024/1104 == 1384/1392/1400/1480
  (intra-record mod 376: 256/264/272/360 — the t_oproc/t_stop/t_param/t_unhold fields)

=== Patched kernel (#1) ===
TOTAL kernel-range pointers leaked      : 0
  of which kernel .text/.rodata (FN)    : 0
  of which heap/direct-map              : 0
VERDICT: NO LEAK — pointer fields are sanitized (fixed kernel).