{
  "finding_id": "DF-2783",
  "status": "reproduced",
  "reproduced": 1,
  "impact": "leak",
  "confidence": "certain",
  "verdict": "sys___semctl IPC_STAT (sysv_sem.c:431) copyout of the live semid_ds discloses the kernel heap pointer sem_base (M_SEM allocation) to any unprivileged user with IPC_R access (own semget). Reproduced on stock kernel: sem_base=0xfffff8008d363168 identical across 3 runs, uid 1001. SEM_STAT (:450) has the same code but is dead (pre-switch seq check :376-380 vs in-case index check :441 are mutually exclusive).",
  "exploit_chain": "",
  "evidence": [
    "run.log: 'IPC_STAT : sem_base=0xfffff8008d363168' x3 + 'LEAK: kernel pointer disclosed to uid=1001'",
    "leak_sample.txt: 3 further kernel-address samples",
    "VERDICT.md: baseline vs patched comparison"
  ],
  "kernel_refs": [
    "sys/kern/sysv_sem.c:425-433",
    "sys/kern/sysv_sem.c:434-453",
    "sys/kern/sysv_sem.c:698"
  ],
  "poc_changes": "SEM_STAT probe changed from IPC id to array index, then to informational: kernel's pre-switch seq check (376-380) plus in-case index check (441) make SEM_STAT unconditionally EINVAL (dead command, noted); leak proven via IPC_STAT alone.",
  "attempts": 3,
  "guest_uname": "DragonFly dfbsd 6.5-DEVELOPMENT #0: Thu Jul  2 06:02:54 UTC 2026 root:dfbsd:/usr/obj/usr/src/sys/X86_64_GENERIC x86_64",
  "runtime_sec": 30,
  "guest_dirty": 0,
  "build_cmd": "cc -O2 -Wall -o ipcstat_leak ipcstat_leak.c",
  "run_cmd": "./ipcstat_leak (as uid 1001, x3)",
  "code_hash": "de40833648fa74ef196b48362e2c3416df70052c3a22f33da341d1e8016a0c8c",
  "notes": "No memory corruption; pointer disclosure defeats kernel heap-address randomization and aids heap-layout inference. SEM_STAT dead-command observation included in README.",
  "recommended_fix": "Copy semid_ds to stack, NULL sem_base before copyout in IPC_STAT and SEM_STAT (validated: pointer prints 0x0, rc=2).",
  "fix_status": "fixed",
  "fix_kernel_uname": "DragonFly dfbsd 6.5-DEVELOPMENT #1: Tue Sep  1 06:03:53 UTC 2026 root:dfbsd:/usr/obj/usr/src/sys/X86_64_GENERIC x86_64",
  "fix_baseline_reproduced": 1,
  "fix_patched_reproduced": 0,
  "fix_verdict": "Patched kernel (fix.diff applied in-guest, nativekernel build RC=0, installkernel RC=0) prints sem_base=0x0 / 'clean' rc=2; leak gone, IPC_STAT otherwise functional.",
  "fix_evidence": [
    "run.fixed.log: 'IPC_STAT : sem_base=0x0 nsems=3 mode=1600' + 'clean: kernel pointer zeroed to uid=1001'",
    "fix.diff"
  ]
}