Unprivileged read of the leaked pointer — captured LIVE during the stock-kernel
run (kernel #0, ~10:29 UTC), host side:

  $ dfbsd-qemu/vm.sh run_user 'dmesg | grep -c "volconf update"; dmesg | grep "volconf update" | head -2; grep -c "volconf update" /var/log/messages'
  2
  volconf update 0xfffff801177797c0
  volconf update 0xfffff801177797c0
  2

Interpretation:
  * line 1  (2)          -> regular user 'maxx' sees both leak lines via dmesg
                            (msgbuf is world-readable on this system; dmesg(8)
                            needs no privileges here)
  * lines 2-3            -> the leaked kernel heap address itself:
                            hmp->iocom.conn_state, a kmalloc'd kdmsg_state_t
  * line 4  (2)          -> the same lines also persisted into
                            /var/log/messages via syslogd

(Transcribed verbatim from the verification session transcript; the guest
file holding the stock dmesg was later overwritten by the fix-validation
re-run, but the full stock run script output — including these counts and
pointer values — is preserved untrimmed in run.log.)