# DF-2557 — SO_PASSCRED SCM_CREDS synthesis uninitialized-stack info leak

## Bug
`sys/kern/uipc_usrreq.c:683` declares `struct cmsgcred cred;` with no
initializer. When an AF_UNIX `SOCK_DGRAM` receiver has `SO_PASSCRED` set
and the sender sends a datagram with **no** `SCM_CREDS` ancillary data,
`uipc_send` synthesizes one (lines 694–699):
```c
ncon = sbcreatecontrol(&cred, sizeof(cred), SCM_CREDS, SOL_SOCKET);
unp_internalize(ncon, msg->send.nm_td);
```
`sbcreatecontrol` copies the full `sizeof(cred)` (80 bytes on x86_64) —
including the uninitialized tail — into the control mbuf.
`unp_internalize` (lines 1734–1744) then fills only:
- `cmcred_pid`, `cmcred_uid`, `cmcred_euid`, `cmcred_gid`, `cmcred_ngroups`
- `cmcred_groups[0 .. ngroups-1]`

Leaving the 2 bytes of padding after the short `cmcred_ngroups` and the
groups `[ngroups .. CMGROUP_MAX-1]` (up to 60 bytes for a typical 1-group
user) as raw kernel-stack residue, delivered verbatim to the receiving
socket.

## Impact
Kernel stack info leak (CWE-908/CWE-200).  Up to 62 bytes per datagram of
uninitialized kernel-stack residue are made readable by any local
unprivileged user, in a tight loop.  Useful as a KASLR / stack-residue
oracle ingredient for a separate kernel exploit.  No write primitive —
the leak itself is the finding.

## Build & run
```
./build.sh          # cc -O2 -o leak_cmsgcred leak_cmsgcred.c
./run.sh            # ./leak_cmsgcred 3   (unprivileged)
```

## Expected output (unpatched, bug present)
A hex dump of the received 80-byte `struct cmsgcred` in which the padding
bytes after `cmcred_ngroups` and the tail `groups[ngroups..CMGROUP_MAX-1]`
are **non-zero kernel-stack residue** that varies between samples; the
`LEAK CONFIRMED` summary line.

## Expected output (patched, bug gone)
The same bytes are all `0x00` and the program prints `NO LEAK`.

## Reproduction environment
DragonFly 6.5-DEVELOPMENT master DEV, `X86_64_GENERIC` (INVARIANTS ON),
`with-src` snapshot.  Fully unprivileged: `socketpair`, `setsockopt`,
`send`, `recvmsg`.  No setup, no root, no special config.