DF-4012 leak sample -- kernel pointers disclosed by unprivileged
(uid=2) MPTIOCTL_REG_ACCESS REG_MEM_READ via the REAL production
mps_user_reg_access inline (assembled verbatim from the session
transcript; see rig_run.log RUN 3 for context).

Scan: 49152 qwords (384 KiB) at [BAR+0x400000, BAR+0x460000),
BAR=0xfffff80118620000, aperture = 0x1000.  639 of 49152 qwords were
kernel pointers.  First 12 samples:

+0x00400008: 0xfffff8004f064000   kmem heap pointer (objcache/slab)
+0x00400018: 0xfffff80118680010   kmem heap pointer
+0x00400030: 0xfffff80118bc0200   kmem heap pointer (same-region freelist)
+0x00400058: 0xfffff80118bc0050   kmem heap pointer
+0x00400080: 0xffffffff00000000   kernel-image-half tag
+0x00414210: 0xfffff801186fa000   kmem heap pointer
+0x00414230: 0xfffff8008d1ff030   kmem heap pointer
+0x00414238: 0xfffff8008d1ff030   kmem heap pointer
+0x00414240: 0xffffffff81457d40   KERNEL IMAGE pointer (.data/.bss)
+0x00414268: 0xffffffff807b1af0   KERNEL IMAGE pointer
+0x00414278: 0xfffff80118bd4200   kmem heap pointer
+0x00414308: 0xfffff801186fa000   kmem heap pointer

DF-4020 twin (same accessor inline, mpr): the pair-scan run READ the
child brood's struct proc array at BAR+~148 MiB (0xfffff801179d36dc
etc., 16 procs at 0x500 stride) -- full kernel-structure disclosure
past the aperture; see DF-4012/rig_run.log RUN 4 and DF-4020's
prior-session leak_sample.txt (replica runs).