DF-3386 environment
===================

uname -a (baseline / stock, leak reproduced):
  DragonFly dfbsd 6.5-DEVELOPMENT DragonFly 6.5-DEVELOPMENT #0: Thu Jul  2 06:02:54 UTC 2026     root@dfbsd:/usr/obj/usr/src/sys/X86_64_GENERIC  x86_64

uname -a (fixed kernel, fix validation -- red[] all zero, handle = real qid):
  DragonFly dfbsd 6.5-DEVELOPMENT DragonFly 6.5-DEVELOPMENT #1: Fri Sep 11 23:03:53 UTC 2026     root@dfbsd:/usr/obj/usr/src/sys/X86_64_GENERIC  x86_64

struct sizes on this build: sizeof(class_stats_t)=264, sizeof(struct redstats)=56
(red[3] occupies bytes 96..263 of the copied-out struct; handle bytes 0..3)

ALTQ compiled in GENERIC (ALTQ_CBQ, ALTQ_RED, ALTQ_RIO); pf loaded as KLD.

sysctl kern.securelevel: -1

Trigger requirements: root (/dev/pf).  Info leak of kernel stack
(64-bit kernel pointers, see leak_sample.txt) to a privileged caller.