# DF-2718 VERDICT

**Status: reproduced — impact: leak — confidence: certain.**

## What was run

Guest: DragonFly 6.5-DEVELOPMENT #0 (INVARIANTS X86_64_GENERIC), uid 1001 (maxx).

1. `make_poc.py` → `poc_unterm`: ELF64, PT_INTERP p_filesz=1024, file bytes
   all 'A' with no NUL. Exec'd under `script(1)` so the process has a
   controlling terminal (uprintf output reaches us).
2. `make_poc2.py` → `seed1024` (interp = 1024 'B', unterminated) and
   `leak1000` (interp = 1000 'A', unterminated). The seed exec occupies a
   1024-size-class kmalloc(M_TEMP) slot and frees it (imgact_elf.c:845);
   the leak exec's `kmalloc(1000)` reuses the same 1024-class slot, so bytes
   1000..1023 are the freed allocation's residue.

## Observed

- run.log: `ELF interpreter A×1024 not found` — uprintf walked one byte past
  the kmalloc'd buffer (stopped at a zero byte in a fresh slab page).
- run2.log (20 seed/leak pairs): **18/20** iterations printed
  `A×1000 + B×24` — the 24 B's are kernel-heap bytes from a different, freed
  M_TEMP allocation (imgact_elf.c:844 %s, imgact_elf.c:668 allocation).
- iteration 15 additionally leaked real kernel path-string residue:
  `…BBBBBBBxx/.ssh/autho/home/maxx not found` — genuine kernel heap data
  (nlookup/namei path residue in the same size class), not attacker-supplied.

## Impact

Unprivileged local kernel-heap information disclosure. Length of the
disclosure is unbounded until the first NUL byte; contents are whatever
follows in the M_TEMP size class (paths, and potentially pointers/binary
data — iteration 15 shows binary non-ASCII bytes too). Also an unbounded
`%s` walk in kernel address space (imgact_elf.c:844) — in principle able to
walk into unmapped KVA; not observed across 40+ runs on this guest.

No uid=0 chain: leak-only primitive (contents are not attacker-steerable
beyond grooming residue).

## Fix validation

fix.diff adds the NUL-termination check in `extract_interpreter`
(mirrors FreeBSD). Patched kernel build + rerun: leak gone (see
fix_build.log / fix_run.log in this pack if present), baseline re-verified
before patching.