# DF-3080 — VERDICT

**Status: reproduced** (1 run, deterministic behavior; guest stayed up).
**Impact: leak (trivial)** — unprivileged users can open and read kernel
proc0's (swapper) procfs pseudo-files.

## How it reproduces
- `atopid("0")` → 0; `pid == NO_PID` guard passes
  (sys/vfs/procfs/procfs_vnops.c:798-800).
- `pfs_pfind(0)` returns `&proc0` via the pid-0 special case
  (sys/vfs/procfs/procfs_subr.c:285-287) — no allproc/zombie filtering
  applies.
- `security.ps_showallprocs=1` (default, verified in env.txt) makes the
  uid gate at sys/vfs/procfs/procfs_vnops.c:809-811 a no-op for this case.
- `procfs_allocvp(..., 0, Pproc)` creates the directory node; per-target
  gates then apply exactly as for any process: status/cmdline/rlimit are
  world-readable (mode 0444), mem/ctl are denied for non-root (verified:
  `dd /proc/0/mem` → Permission denied).

Observed (uid 1001 maxx, full log in run.log):
```
/proc/0: dr-xr-xr-x  16 root wheel ...
status: swapper 0 0 0 0 -1,-1 sldr <epoch>,145 0,0 3,294605 idle 0 0 0,0 -
rlimit: cpu -1 -1 / fsize -1 -1 / data 134217728 34359738368
readdir: '0' is listed (proc0 is on allproc)
```

## Why it is only Info
Every field readable through /proc/0/status is independently public:
boot time (`kern.boottime`), idle cpu (`kern.cp_time`), root's groups
(`/etc/group`). rlimits of proc0 are kernel defaults. mem/regs/ctl/map/
etype stay denied (CHECKIO + mode gates + P_SYSTEM valid* checks —
procfs_vnops.c:136-144, procfs_regs.c:79-81, procfs_map.c:254-256,
procfs_type.c:76-78). The finding documents a namespace-hygiene defect
and a latent hazard (kernel-internal object addressable; pid-0 path skips
pfind's list protections), not a confidentiality breach with delta.

## Fix validation
Not rebuilt (Info finding). `fix.diff` rejects pid 0 at the Proot lookup
case and skips pid 0 rows in the readdir callback — no pfs_pfind change
needed (pid 0 remains meaningful for Proot/Pcurproc nodes).
fix_status: not_testable (authored only).