# DF-4673 — METEORSETGEO grow installs an unzeroed frame buffer → stale-memory disclosure via mmap

**Status: REPRODUCED (leak, cross-privilege). 14,117 of 16,444 mapped
pages carried ROOT's sprayed memory markers, read back by uid 1001
through the production grow path + verbatim bktr_mmap. Fix validated
(zeroed on the fixed kernel).**

## Build

```
./build.sh    # poc_stalebuf (unpriv) + spray (root groomer); rig as in DF-4672
```

## Run

```
./run.sh      # preconditions: rig loaded, reserve drained (DF-4672 storm);
              # root sprays 2600 MiB marked pages and exits; maxx grows+mmaps+reads
```

## Expected (baseline / stock kernel)

```
grow -> alloc_pages=384 wire_delta=+960 (SCAN-path)  << RECYCLED PAGES
  ROOT-SECRET page 0 (tag=41 spraypage=121355):
    page 0: 524f4f5453454352 0000000000000029 000000000001da0b 004446343637332d ...
 -> scanned 384 pages: 383 nonzero, 0 kptr, 383 ROOT-SECRET
== RESULT ==
root-spray secret pages disclosed to unprivileged user: 14117
KERNEL MEMORY DISCLOSURE CONFIRMED (cross-privilege)
```

On the fixed kernel (DF467XFIX): every grown buffer all-zero, 0 secrets.