DF-3297 leak sample — DIOCGETSRCNODES via O_RDONLY fd on /dev/pf (run 1 & 2)

Guest: DragonFly dfbsd 6.5-DEVELOPMENT #0 X86_64_GENERIC (pf.ko loaded)
Setup: pfctl -f srcnodes.conf ; pfctl -e ; connects from 127.0.0.2-8
(lo0 aliases) to 127.0.0.1:65001 under `keep state (max-src-states 100)`.

struct pf_src_node offsets (x86_64, sizeof=152):
  +0x00 rbe_left / +0x08 rbe_right / +0x10 rbe_parent / +0x14 rbe_color
  +0x20 addr / +0x30 raddr / +0x40 rule (union ptr|nr) / +0x48 kif
  +0x50 bytes[2] / +0x60 packets[2] / +0x70 states|conn
  +0x78 conn_rate / +0x88 creation|expire / +0x90 af|ruletype

LEAKED (verbatim kernel heap pointers, 0xfffff8xx_xxxxxxxx DFly KVA):
  run A node0: +0x10 = 0xfffff8008bb64500 (rbe_parent)
  run A node1: +0x00 = 0xfffff8008bb64460 (rbe_left), +0x08 = 0xfffff8008bb645a0 (rbe_right)
  run A node3: +0x10 = 0xfffff8011757d6e0 (rbe_parent)
  run A node4: +0x00 = 0xfffff8011757d5a0, +0x08 = 0xfffff8011757d640
  run A node8: +0x08 = 0xfffff8011760eb40
  run A node9: +0x10 = 0xfffff8011760eaa0
(Second dump minutes later reproduced identical pointers for surviving
 nodes — e.g. 0xfffff8008bb64500 stable across both runs.)

The kernel sanitizes ONLY pstore->rule.nr (a 4-byte store into the 8-byte
union pf_rule_ptr at +0x40, pf_ioctl.c:2886); rbe_* at +0x00/+0x08/+0x10
are copied and copyout()ed verbatim (pf_ioctl.c:2884 bcopy + 2902 copyout).
kif is NULL by construction (pf_insert_src_node never sets it, pf.c:582).

Note: entries printed by the PoC as "<-- kernel pointer" at +0x80 are
conn_rate.last timestamps (false positives of the >>47 heuristic); the
genuine disclosures are the 0xfffff8.. values listed above.