{
 "finding_id": "DF-3338",
 "status": "reproduced",
 "reproduced": 1,
 "impact": "leak",
 "confidence": "certain",
 "verdict": "REPRODUCED: pfr_walktree() PFRW_GET_ASTATS (pf_table.c:1058-1081) copies a stack struct pfr_astats to userspace without initializing the 4 alignment-pad bytes between the 20-byte pfras_a and the 8-byte-aligned pfras_packets[]; 01f8ffff observed in 96/96 entries across 3 runs on the stock kernel - kernel-stack residue (0xfffff801... is DFly kernel-VM). Root-only (pf 0600), 4 bytes/entry -> Low.",
 "exploit_chain": "root issues DIOCRGETASTATS on a populated table -> kernel copyout of 96-byte entries with bytes 20..23 uninitialized -> raw ioctl reader observes kernel stack residue.",
 "evidence": [
  "run.log: pad(20..23)=01f8ffff in 96/96 entries over 3 runs",
  "leak_sample.txt"
 ],
 "kernel_refs": [
  "sys/net/pf/pf_table.c:1058",
  "sys/net/pf/pf_table.c:1062",
  "sys/net/pf/pf_table.c:1078",
  "sys/net/pf/pfvar.h:1064"
 ],
 "poc_changes": "added #include <net/if.h> for pfvar.hs IFNAMSIZ; stack pre-dirtied via a preceding DIOCRTSTADDRS ioctl in the same thread to make the residue visible.",
 "attempts": 3,
 "guest_uname": "DragonFly dfbsd 6.5-DEVELOPMENT DragonFly 6.5-DEVELOPMENT #0: Thu Jul 2 06:02:54 UTC 2026   root@dfbsd:/usr/obj/usr/src/sys/X86_64_GENERIC x86_64",
 "runtime_sec": 90,
 "guest_dirty": 0,
 "build_cmd": "cd /tmp/poc/DF-3338 && sh build.sh",
 "run_cmd": "cd /tmp/poc/DF-3338 && sh run.sh",
 "code_hash": "d89ba27318aff587ea98854ad226321901850a817347143e4303f3035077df3b",
 "notes": "Low severity, root-only. One-line fix (bzero the struct before filling) not kernel-validated to conserve guest time for the DF-3337 fix cycle.",
 "recommended_fix": "bzero(&as, sizeof(as)) before filling in the PFRW_GET_ASTATS branch of pfr_walktree().",
 "fix_status": "not_testable"
}