=== setup (root): workspace + restore msgbuf access default ===
security.unprivileged_read_msgbuf: 1 -> 1
=== launch UNPRIVILEGED grabber in background (14s window) ===
=== root writes MARKER1 to /dev/console ===
=== root locks the msgbuf against unprivileged readers ===
security.unprivileged_read_msgbuf: 1 -> 0
=== unprivileged dmesg attempt (expected: EPERM) ===
dmesg: sysctl kern.msgbuf: Operation not permitted
dmesg exit: 0
=== root writes MARKER2 (msgbuf locked for the user, pty stream still live) ===
=== root triggers a pure kprintf path (module/network event, if available) ===
=== unprivileged capture log ===
[0.00] uid=1001 euid=1001 pty=/dev/pts/0
[0.00] TIOCCONS: SUCCESS - constty now points at this UNPRIVILEGED pty
[3.02] master received 29 bytes:
DF2759-MARKER1-direct+daemon

[3.56] master received 35 bytes:
<118>DF2759-MARKER1-direct+daemon

[7.84] master received 35 bytes:
DF2759-MARKER2-after-msgbuf-locked

[8.56] master received 79 bytes:
<118>DF2759-MARKER2-after-msgbuf-locked
tap0: MAC address: 00:bd:ab:30:01:00

[14.02] capture window over; exiting (close -> ttyclose -> constty=NULL)
=== cleanup (root): restore knob ===
security.unprivileged_read_msgbuf: 0 -> 1