# DF-2637 — kernel heap-pointer (%p) disclosures in hammer2_inode error paths

## What
Four `kprintf("%p")` sites in sys/vfs/hammer2/hammer2_inode.c print raw
kernel inode/vnode addresses to the console/msgbuf on error paths that can
be reached at runtime:

* hammer2_inode.c:711-712 — `kprintf("hammer2: igetv race %p/%p\n", ip->vp, vp)`
* hammer2_inode.c:1726 — `kprintf("hammer2: unable to fsync inode %p\n", ip)`
* hammer2_inode.c:1761-1762 — `kprintf("hammer2: backend unable to insert inode %p %ld\n", ...)`
* hammer2_inode.c:1800-1801 — `kprintf("hammer2: backend unable to delete inode %p %ld\n", ...)`

The msgbuf is readable by unprivileged users via `dmesg` (world-readable
kernel message buffer on stock DragonFly).  Combined with a separate
heap-address leak primitive, this defeats heap-layout randomization for
slab-grooming attacks; on its own it is a hardening issue (CWE-200 /
CWE-497).  Same class as DF-2614 (iocom %p leaks), distinct sites.

## Trigger sketch
Repeated lookup/igetv races or fsync failures (e.g. ENOSPC-pressure on a
full PFS, per DF-2633 write failures surface here as fsync errors) print
the addresses.  Not guest-verified this run (Low severity; skipped per
audit contract — see verdict.json).

## Fix
Drop the %p (or print the inum only):
```diff
-	kprintf("hammer2: unable to fsync inode %p\n", ip);
+	kprintf("hammer2: unable to fsync inode %ld\n", (long)ip->meta.inum);
```
(and equivalents at the other three sites).