# DF-2689 — Leftover `DEBUG:` kprintf in `vm_pageout_scan_hold` leaks kernel pointers and spams the console on a normal race-handling path

File: `sys/vm/vm_pageout.c:1932` (`vm_pageout_scan_hold`).

## Status

**UNTESTED (Info — hardening).** Source-evident; no runtime demonstration
needed or attempted (guest left clean). The print fires on the *handled*
PQ_HOLD race residue path (page left on PQ_HOLD with `hold_count == 0` by
the documented `vm_page_free`/`vm_page_unhold` race,
sys/vm/vm_page.c:1403-1410), i.e. every occurrence prints a raw `vm_page_t`
pointer and a per-occurrence line to the console/message buffer.

## What it is

```c
if (m->hold_count)
        break;
kprintf("DEBUG: pageout HOLD->FREE %p\n", m);   /* <-- :1932 */
vm_page_hold(m);
...
vm_page_unhold(m);       /* reprocess */
```

Impact: (1) unprivileged-triggerable console/log spam on a nominally silent
recovery path (the underlying race is driven by ordinary memory pressure);
(2) kernel heap-pointer disclosure to any local user who can read the
message buffer (dmesg), a KASLR-defeating primitive on kernels that use
KASLR and needless information exposure otherwise. Severity: Info on
current DragonFly (no KASLR by default).

## Fix

Delete the line (see fix.diff). The hold/unhold "reprocess" dance itself was
re-verified correct against `vm_page_unhold`'s re-test protocol
(sys/vm/vm_page.c:1413-1432) — pages parked on PQ_HOLD have already been
disassociated from their object (`vm_page_free_toq` → `vm_page_remove`,
sys/vm/vm_page.c:3186), no stray holders can exist, and the final unhold
re-checks under both spinlocks before moving the page to PQ_FREE.