# DF-2925 — uninitialized kernel stack disclosed through quota accounting

`cmd_set_limit()` (sys/kern/vfs_quota.c:273-284) declares `uint64_t limit`
uninitialized, discards the return of `prop_dictionary_get_uint64()`
(which leaves `*valp` untouched when the key is absent or not a number —
sys/libprop/prop_dictionary_util.c), and stores the stale stack slot into
`mp->mnt_acct.ac_limit` (:280).  `cmd_get_usage_all()` then echoes
`ac_limit` to userspace (vfs_quota.c:184).  Same pattern for `space` in
`cmd_set_usage_all()` (:249 → :255/:263) and for the `limit`/`uid`/`gid`
locals of cmd_set_limit_uid/gid (:293-294, :314-315).

Unprivileged readout of 8 bytes of kernel stack per call.  The leaked slot
tracks whatever the previous syscall left at that stack depth (observed:
the previous vquotactl's loop counters — the value follows the caller's
prior syscall activity, i.e. steerable stack disclosure; with a
pointer-seeding syscall before vquotactl this leaks kernel addresses).

## Build / run
    cc -O -o vqleak vqleak.c -lprop
    ./vqleak /boot 5

## Expected (unpatched)
    run  0: set=0 get=0  leaked ac_limit=0x0000000000000010 ...
    run  N: leaked ac_limit=<previous syscall's leftover> (varies, nonzero)

On the DF-2922-patched kernel the same command reports ac_limit=0.