{
  "finding_id": "DF-2708",
  "title": "DMSG wire msgid discloses kernel heap pointer of every kernel-initiated transaction state to the cluster peer",
  "verdict": "reproduced",
  "impact": "leak",
  "confidence": "certain",
  "reproduce": {
    "build": "cc -O -I/usr/src/sys -o df2707_trigger df2707_trigger.c (source shared with DF-2707 pack)",
    "run": "sh /root/poc/df2707/run_df2707.sh leak",
    "expected": "AUTO_CONN ... msgid=0xfffff8xxxxxxxxx on stdout equals dmesg 'volconf update 0xfffff8xxxxxxxxx'"
  },
  "kernel_refs": ["sys/kern/kern_dmsg.c:1804", "sys/kern/kern_dmsg.c:1833"],
  "artifacts": ["README.md", "run.log", "dmesg.txt", "manifest.json", "verdict.json"]
}