# DF-2558 — Kernel stack info leak via the AF_UNIX pcblist sysctl

## Bug
`sys/kern/uipc_usrreq.c:1465` — `unp_pcblist()` (the handler behind
`net.local.{dgram,stream,seqpacket}.pcblist`) declares
```c
struct xunpcb xu;          /* ON THE STACK, NO INITIALIZER, 912 B */
```
and only fills `xu_len`, `xu_unpp`, a partial `bcopy` of `unp_addr`/conn
addr (≤ `sun_len` bytes of two 256-byte unions), the full `xu_unp`, and
`xu_socket`. The trailing bytes of `xu_addr`/`xu_caddr` past `sun_len`
plus the 8-byte `xu_alignment_hack` trailer (`sys/sys/unpcb.h:126`,
**never** written) stay as raw kernel-stack residue. `SYSCTL_OUT(req,&xu,
sizeof xu)` then copies the whole struct verbatim to userspace
(`uipc_usrreq.c:1498`).

The pcblist sysctl nodes are `CTLFLAG_RD` with no privilege check
(`uipc_usrreq.c:1511-1519`), so any unprivileged local user can read them.

## Impact
Kernel stack info leak (CWE-908 / CWE-200). Up to ~510 bytes per PCB of
uninitialized kernel-stack residue — including a canonical kernel-virtual
pointer in `xu_alignment_hack` every record — are readable by any local
unprivileged user, in a tight loop. Useful as a KASLR / stack-residue
oracle for a separate kernel exploit. No write primitive — the leak itself
is the finding (Medium).

## Build & run
```
./build.sh          # cc -O2 -o poc poc.c
./run.sh            # ./poc 3   (unprivileged)
```

## Expected output (unpatched, bug present)
A per-record breakdown in which `xu_addr` tail / `xu_caddr` /
`xu_alignment_hack` carry **non-zero kernel-stack residue** that varies
between samples (e.g. `xu_alignment_hack (8 B): 90870e81 ffffffff` =
`0xffffffff810e8790`), and the `LEAK CONFIRMED` summary line. Typical
leak: ~300 non-zero bytes/record out of ~500 possible; ~12k non-zero
bytes over 3 sysctl reads.

## Expected output (patched, bug gone)
The same regions are all `0x00` and the program prints `NO LEAK`
(`0 leaked non-zero bytes`).

## Reproduction environment
DragonFly 6.5-DEVELOPMENT master DEV, `X86_64_GENERIC` (INVARIANTS ON),
`with-src` snapshot. Fully unprivileged: `socket`+`bind` AF_UNIX,
`sysctlnametomib`, `sysctl(2)`. No setup, no root, no special config.