# DF-2715 - Verification Verdict

**Status:** reproduced
**Impact:** leak
**Confidence:** certain

## Mechanism
kern_recvmsg ORs the kernel-internal force flags MSG_FNONBLOCKING/MSG_FBLOCKING (0x20000/0x10000, sys/socket.h:398-399) into its flags variable when the file is non-blocking; sys_recvmsg then copyout()s that same variable over the user msghdr.msg_flags with nothing stripping the kernel-only bits.

## Verdict
REPRODUCED unprivileged on the stock guest: recvmsg on an O_NONBLOCK UDP socket with a queued datagram returns msg_flags = 0x00020000 - the kernel-internal MSG_FNONBLOCKING bit is visible in the user msghdr (twice, deterministic). POSIX defines msg_flags as an output field carrying MSG_TRUNC/MSG_CTRUNC/MSG_EOR-class status; two bits of kernel-internal state (which blocking mode the kernel forced) leak into every such recvmsg.

## Threat / reachability
ABI/state disclosure to any local user; also a compatibility hazard (apps keying unknown msg_flags bits).

## Privilege escalation assessment
n/a (info leak of kernel state bit)

## Fix
Strip MSG_FNONBLOCKING|MSG_FBLOCKING from *flags after so_pru_soreceive returns.

## Kernel references
- `sys/kern/uipc_syscalls.c:996`
- `sys/kern/uipc_syscalls.c:999`
- `sys/kern/uipc_syscalls.c:1190`
- `sys/sys/socket.h:399`

## Fix status (batch validation)
Applied with the 36 sibling fix.diffs of this batch in findings/poc/_batch41/all_fixes.patch; single in-guest `make -j6 nativekernel KERNCONF=X86_64_GENERIC` completed RC=0 with zero errors under -Werror (full log: findings/poc/_batch41/fix_build8.log). Behavior A/B intentionally skipped for this Info-tier item.