{
  "finding_id": "DF-2637",
  "status": "untested",
  "reproduced": 0,
  "impact": "none",
  "confidence": "certain",
  "verdict": "Low-severity hardening finding: four kprintf %p sites in hammer2_inode.c (igetv race at :711, fsync failure at :1726, chain insert failure at :1761, chain delete failure at :1800) print kernel inode/vnode addresses to the console/msgbuf on error paths reachable at runtime; dmesg is readable by unprivileged users on stock DragonFly. Guest verification intentionally skipped per audit contract (Low/Info).",
  "exploit_chain": "",
  "evidence": "README.md quotes all four sites with path:line",
  "kernel_refs": ["sys/vfs/hammer2/hammer2_inode.c:711-712", "sys/vfs/hammer2/hammer2_inode.c:1726", "sys/vfs/hammer2/hammer2_inode.c:1761-1762", "sys/vfs/hammer2/hammer2_inode.c:1800-1801"],
  "poc_changes": "",
  "attempts": 0,
  "guest_uname": "",
  "runtime_sec": 0,
  "guest_dirty": 0,
  "build_cmd": "",
  "run_cmd": "",
  "code_hash": "",
  "notes": "Same class as DF-2614 (iocom %p leaks), distinct file/sites. Aids slab-grooming when combined with any heap-address-dependent primitive.",
  "recommended_fix": "Drop %p from the four kprintfs; print meta.inum instead."
}