cbq configured: sizeof(class_stats_t)=264 sizeof(struct redstats)=56 active altq entries: 3, ticket=1 q_def is active entry nr=2 === run 1 (nbytes=264) === handle field (offset 0, uninit): 0x809af7ee qtype=0 (1=droptail,2=RED,3=RIO) qcnt=0 full dump (0x41 == untouched prefill): 0: ee f7 9a 80 00 00 00 00 00 00 00 00 00 00 00 00 16: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 32: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 48: 00 00 00 00 00 00 00 00 01 00 00 00 19 00 00 00 64: e7 ff ff ff 01 00 00 00 1e 00 00 00 02 00 00 00 80: 00 00 00 00 00 00 00 00 19 00 00 00 00 00 00 00 96: 00 00 00 00 00 04 00 00 ec 9b 75 81 ff ff ff ff 112: ec 9b 72 81 ff ff ff ff 00 00 01 00 00 00 00 00 128: f8 e5 c0 80 ff ff ff ff 38 d6 65 18 01 f8 ff ff 144: 18 fd c0 80 ff ff ff ff 00 00 00 00 00 00 00 00 160: fd 0c 00 00 00 00 00 00 00 40 06 4f 00 f8 ff ff 176: 00 00 00 00 01 f8 ff ff fd 00 00 00 49 01 00 00 192: 80 99 5e 49 00 f8 ff ff a0 51 9b 17 01 f8 ff ff 208: 73 00 00 00 00 00 00 00 03 00 00 00 00 00 00 00 224: 80 99 5e 49 00 f8 ff ff a8 d6 65 18 01 f8 ff ff 240: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 256: 80 0b 61 81 ff ff ff ff === run 2 (nbytes=264) === handle field (offset 0, uninit): 0x809af7ee qtype=0 (1=droptail,2=RED,3=RIO) qcnt=0 full dump (0x41 == untouched prefill): 0: ee f7 9a 80 00 00 00 00 00 00 00 00 00 00 00 00 16: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 32: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 48: 00 00 00 00 00 00 00 00 01 00 00 00 19 00 00 00 64: e7 ff ff ff 01 00 00 00 1e 00 00 00 02 00 00 00 80: 00 00 00 00 00 00 00 00 19 00 00 00 00 00 00 00 96: 00 00 00 00 00 04 00 00 ec 9b 75 81 ff ff ff ff 112: 80 50 9b 17 01 f8 ff ff 00 00 01 00 00 00 00 00 128: cb 33 9a 80 ff ff ff ff 04 00 00 00 00 00 00 00 144: 80 50 9b 17 01 f8 ff ff 80 50 9b 17 01 f8 ff ff 160: a8 d8 65 18 01 f8 ff ff 88 d6 65 18 01 f8 ff ff 176: 70 d6 65 18 01 f8 ff ff 80 22 86 16 01 f8 ff ff 192: 00 19 5b 40 00 f8 ff ff a0 51 9b 17 01 f8 ff ff 208: 99 00 00 00 00 00 00 00 05 00 00 00 00 00 00 00 224: 00 19 5b 40 00 f8 ff ff a8 d6 65 18 01 f8 ff ff 240: 00 00 00 00 00 00 00 00 00 d8 65 18 01 f8 ff ff 256: ff ff ff ff 00 00 00 00 === run 3 (nbytes=264) === handle field (offset 0, uninit): 0x809af7ee qtype=0 (1=droptail,2=RED,3=RIO) qcnt=0 full dump (0x41 == untouched prefill): 0: ee f7 9a 80 00 00 00 00 00 00 00 00 00 00 00 00 16: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 32: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 48: 00 00 00 00 00 00 00 00 01 00 00 00 19 00 00 00 64: e7 ff ff ff 01 00 00 00 1e 00 00 00 02 00 00 00 80: 00 00 00 00 00 00 00 00 19 00 00 00 00 00 00 00 96: 00 00 00 00 00 04 00 00 ec 9b 75 81 ff ff ff ff 112: 80 50 9b 17 01 f8 ff ff 00 00 01 00 00 00 00 00 128: cb 33 9a 80 ff ff ff ff 04 00 00 00 00 00 00 00 144: 80 50 9b 17 01 f8 ff ff 80 50 9b 17 01 f8 ff ff 160: a8 d8 65 18 01 f8 ff ff 88 d6 65 18 01 f8 ff ff 176: 70 d6 65 18 01 f8 ff ff 80 22 86 16 01 f8 ff ff 192: 00 19 5b 40 00 f8 ff ff a0 51 9b 17 01 f8 ff ff 208: 99 00 00 00 00 00 00 00 05 00 00 00 00 00 00 00 224: 00 19 5b 40 00 f8 ff ff a8 d6 65 18 01 f8 ff ff 240: 00 00 00 00 00 00 00 00 00 d8 65 18 01 f8 ff ff 256: ff ff ff ff 00 00 00 00 Interpretation: any byte != 0x41 in the first 4 bytes (handle) and in the last 168 bytes (red[3]) is uninitialized kernel stack leaked to userspace.