# DF-2674 — vm_map_growstack() maps grown stack pages RWX (W^X weakening)

## What

`vm_map_growstack()` inserts grown stack pages with hardcoded
`VM_PROT_ALL, VM_PROT_ALL` (sys/vm/vm_map.c:4246-4251), ignoring the
protection of the stack entry being grown.  The main stack is mapped by
exec with `prot = VM_PROT_READ|VM_PROT_WRITE` (non-executable current
protection; sys/kern/kern_exec.c:991-995) — but every region the stack
grows **into** silently becomes readable/writable/**executable**.

## Impact

Silent defeat of non-executable-stack hardening for grown stack regions:
attackers exploiting a stack overflow gain an executable landing area
below the original stack mapping without calling mprotect.  (max_protection
of the stack includes EXEC, so the boundary was always user-raisable; the
defect is that growth raises *current* protection unprompted.)

## Reproduce (unprivileged)

```
./build.sh && ./run.sh    # cc -O2 -o ~/poc/stack_growx stack_growx.c; run
```

Observed `/proc/self/map` (before → after faulting 1 page below the stack):

```
before: 0x00007fffffde0000-0x00007fffffdfe000 rw-
after:  0x00007fffffdc0000-0x00007fffffde0000 rwx   <-- grown chunk
        0x00007fffffde0000-0x00007fffffdfe000 rw-
```

## Fix

`fix.diff` — inherit `stack_entry->protection` / `stack_entry->max_protection`
for the growth insert (matches FreeBSD semantics).