{
  "finding_id": "DF-2708",
  "status": "reproduced",
  "reproduced": 1,
  "impact": "leak",
  "confidence": "certain",
  "verdict": "kdmsg_msg_alloc() sets state->msgid = (uint64_t)(uintptr_t)state (kern_dmsg.c:1804) and transmits it as head.msgid (:1833), disclosing the kmalloc'd kdmsg_state_t heap address of every kernel-initiated transaction to the cluster peer. Verified on the stock INVARIANTS guest: the auto-LNK_CONN observed on the peer socket carried msgid=0xfffff8011741eae0 and dmesg simultaneously printed 'volconf update 0xfffff8011741eae0' for the same object (hmp->iocom.conn_state via the REMOTE_ADD ioctl). Fresh 0xfffff80xxxxxxxxx pointers observed on every mount across 4+ runs.",
  "exploit_chain": "cluster peer reads head.msgid of the kernel's auto-LNK_CONN (one per reconnect) or any kernel-initiated LNK_SPAN -> direct kernel heap pointer -> heap-layout disclosure defeating KASLR-style randomization, priming pointer forgery for same-subsystem corruption bugs (e.g. DF-2707 stale-rbnode writes).",
  "evidence": ["run.log (trigger stdout: AUTO_CONN cmd=80001106 msgid=0xfffff8011741eae0)", "dmesg.txt (volconf update 0xfffff8011741eae0 - identical value, same object)"],
  "kernel_refs": ["sys/kern/kern_dmsg.c:1804", "sys/kern/kern_dmsg.c:1833", "sys/kern/kern_dmsg.c:184-191", "sys/vfs/hammer2/hammer2_iocom.c:376-379"],
  "poc_changes": "Used the DF-2614 cluster_fd mount harness in a leak mode that prints the wire msgid and cross-checks it against the console %p print of conn_state.",
  "attempts": 4,
  "guest_uname": "DragonFly dfbsd 6.5-DEVELOPMENT #0: Thu Jul  2 06:02:54 UTC 2026 X86_64_GENERIC x86_64 (stock INVARIANTS)",
  "runtime_sec": 120,
  "guest_dirty": 0,
  "build_cmd": "cc -O -I/usr/src/sys -o df2707_trigger df2707_trigger.c",
  "run_cmd": "sh /root/poc/df2707/run_df2707.sh leak  (then compare AUTO_CONN msgid vs dmesg 'volconf update')",
  "code_hash": "084a8b6bdb7eb1553cc425e667b44d08a71319384f1737548a40ebac95a1c6e6",
  "notes": "Leak goes to the wire (peer), not to dmesg - different sink than DF-2614's kprintf leak. Receive path requires no CRC/auth. Not locally reachable by unprivileged users (mount/ioctl need root).",
  "recommended_fix": "Allocate kernel-initiated msgids from a per-iocom 64-bit counter under msglk instead of the state pointer (peer-initiated states already use peer-chosen msgids; uniqueness in statewr_tree is the only requirement)."
}