# DF-2734 - Verification Verdict

**Status:** reproduced
**Impact:** leak
**Confidence:** certain

## Mechanism
mapped_ioctl allocates data = kmalloc(size, M_IOCTLOPS, M_WAITOK) (no M_ZERO) or uses the stack ubuf.stkbuf, and for a command with IOC_VOID clear, size>0 and NEITHER IOC_IN NOR IOC_OUT set (direction NONE) hands that uninitialized buffer straight to fo_ioctl - the bzero that protects IOC_OUT commands is skipped entirely.

## Verdict
source-confirmed (no runtime PoC; deterministic code trace of the cited path:line in the read-only sys/ tree). Code-certain mechanism; reachability audit: every in-tree driver switches on exact _IO/_IOR/_IOW/_IOWR-encoded commands, and a dir-NONE size>0 number matches no case (ENOTTY), so no live leak path was found - pure hardening (one bzero covers the forgotten direction). Compile-validated with the batch build.

## Threat / reachability
Any driver that ever accepts a dir-NONE size>0 ioctl would receive (or echo back) uninitialized kernel stack/heap.

## Privilege escalation assessment
n/a (hardening)

## Fix
Drop the IOC_OUT condition: bzero(data, size) whenever size != 0.

## Kernel references
- `sys/kern/sys_generic.c:684`
- `sys/kern/sys_generic.c:695`

## Fix status (batch validation)
Applied with the 36 sibling fix.diffs of this batch in findings/poc/_batch41/all_fixes.patch; single in-guest `make -j6 nativekernel KERNCONF=X86_64_GENERIC` completed RC=0 with zero errors under -Werror (full log: findings/poc/_batch41/fix_build8.log). Behavior A/B intentionally skipped for this Info-tier item.